Slashdot Mirror
PI License May Soon Be Required for Computer Forensics
buzzardsbay writes "The good folks over at Baseline Magazine have an intriguing — and worrisome — report on a movement to limit computer forensics work to those who have a Private Investigator license or those who work for licensed PI agencies. According to the story, pending legislation would limit the specialized task of probing deep into computer hard drives, network and server logs for telltale signs of hacking and data theft to the same people who advertise in the Yellow Pages for surveillance on cheating spouses, workers' compensation fraud and missing persons. Those caught practicing computer forensics without a license could face criminal prosecution."
Am I breaking the law for this? 3.14159268
I thought this article was about the irrational number at first.
I would think that requiring an Investigative license for doing invetigative work would be a good thing.
If brevity is the soul of wit, then how does one explain Twitter?
Nerd rage aside here, the programs in question aren't dangerous, nor do the operators necessarily have to have expertise to use them. What purpose could this legislation possibly serve?
(rot13) rpbzbab@tznvy.pbz
Texas already requires that computer forensics investigators be licensed PIs. The requirement isn't just window dressing, either. Getting a PI license is tough there. That's why there are only about a dozen licensed computer forensics investigators in entire state. Um, and Media Sentry sure as hell ain't one of them...
New snoop-proofing: chmod -R 000 / Anyone who tries to access your drive is obviously trying to perform computer forensics.
09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
How is this a bad thing? Requiring a PI license would imply some level of legitimacy.
"So long as computer forensic specialist implies a PI license" AND NOT "a PI license implies a computer forensic specialist".
After all PI's get to drive around in their employer's red Ferrari and have witty repartee with the English Estate manager (who may or may not be ghostwriting the employer's books) while having casual sexual relationships with clients. In Hawaii. Am I right here folks?
Ubiquitously - A Ubiquity Developer Community
Although I don't think the license should be a PI license. Rather, it should be computer forensics license. Someone with a PI license doesn't necessarily know jack about computers.
Tm
Support TBI Research: http://www.raisinhope.org
Doesn't this simply say that you have to be licenced to do computer forensic work for hire? What does it really say about doing it on your own PC just to learn about it? I suspect there's some mislead impressions being taken here...
I know I'm not supposed to read the article but this is about needing a PI license work for a licensed firm to testify is court. First thing I would tack on would be they should also have there PE licensed firm or not. Yes it's a bit of a slippery slope it might also get the Secret Service and the FBI to get there agents some decent skills since every time I had interaction with it a tar.gz file was unfathomable to them and everything involves lot of baby steps and spoon feeding. Unfortunately most of these investigators are just using some pretty badly written applications and get stumped by anything with real encryption or not running windows, on the good side encase and similar is a good first step in the evidence chain.
No sir I dont like it.
Considering that in some states becoming a licensed PI requires paying a fee and nothing else, I'm not sure the significance of this (other than there will be a lot more wannabe cops running around). Considering the median salary for a PI in the US is ~$32K (wikipedia), if all the CF folks out there have to get PI licensed it should certainly push that up a bit. Man this is idiotic.
Not having a PI license, I'm making this all up.
But a lot of the licensing process for many professions is not so much licensing and testing their skill AT the profession (certainly there is some aspect of that in some case), rather it's ensuring that the practitioner is aware of the legal and procedural environment within which they practice.
Understanding what they can look at, what the limitations they are under in performing their practice, what obligations they have in terms of working with State agencies, what their liabilities are, etc.
As a perfect example, consider a Notary Public. Here's a profession that, at least at the knowledge and technical level, requires little skill. It is almost solely a beauraucratic invention. How to takes signatures, how to validate ID's, the laws and procedures surrounding witness and notarizing signatures. But it's all very formalized to ensure integrity of the process, because of the weight and ramifications the actual signatures carry legally. It's one thing to "sign" something, but getting it notarized is "signing it right" and carries extra weight.
Since computer forensics starts encroaching in to the legal arena, a lot of the "legal mumbo jumbo" surrounding how the evidence is gathered, handled, and processed comes in to play, and licensing the "evidence gatherer" is a mechanism to ensure that the investigator is aware of their limitations and responsibilities under the law to perform their task.
... does it mean I need to grow a big moustache, and do I get a Ferrari with it?
...would stop the RIAA dead in their tracks.
This is just protectionism...
Most states have ridiculous requirements for getting a PI license. You basically can't get one in many states unless you've been a police officer. There is no public interest reason to do this. Requiring the PI license for this is just a gift to all the people who already have PI licenses.
I haven't looked at computer forensics recently, but when I did (roughly five years ago), there were some problems with it. Basically, because of the way that courts certify experts to testify in court, it was impossible to hire a computer forensic expert to work for the defense. It went something like this:
1. To testify as an expert in court, you have to be a member of the leading professional body for your field.
2. The leading professional body of computer forensic experts forbade its members from working for the defense.
Obviously that's problematic. Hopefully it's changed by now.
The other thing I thought was really funny was the way that most computer crime labs staff up with "experts". Rather than hiring people with computer science degrees and training them on how to do police work, they tend to hire police officers and then train them on computer forensics. The good ole boy system at work.
If you had super powers, would you use them for good, or for awesome?
They started it with mandatory licensing. I mean, come on, a license to sell a house? What advanced training does that require? But each group, when it gets big enough, lobbies for this protection of its turf. In NJ you need a license to be an interior decorator.
A guy who comes home and finds his door kicked in does not get to collect finger prints from his house to prove who did it. Frankly, there is no reason why the CEO's nephew should be allowed to pick through a log file like he picks his nose and, upon seeing an IP address with 66.6 in it be allowed to declare 'This is who hacked our computer.'
Yes, it's another unneeded tax, but it's not as bad as the summary makes it sound. Right now, any one can claim to be a computer forensics specialist.
The bills being considered are only about forensic evidence presented in court.
Inventions have long since reached their limit, and I see no hope for further development.-- Frontinus, 1st cent. AD
Let me give you an example of South Carolina professional licenses. I am an engineer, a PE, licensed as an engineer by the state. My degree is in Chemical Engineering, yet my PE license says nothing about chemical engineering... it is no different from a mechanical engineer, electrical engineer, or structural engineer, or any other engineer. I can officially stamp the blueprints for your house, despite the fact I have absolutely no experience in construction or building practice whatsoever. Tne only thing that stops me is ethical guidelines and my own conscience -- neither of which stop a PI.
Track your TV Shows with your iPhone - FREE
Few nerds gather evidence of hacking or data theft for later use in legal proceedings.
So...I know it's against the whole Slashdot mindset to read the article, but I at least skimmed it, and here's what I got out of it.
1. It's a South Carolina thing (And who lives in S.C., anyways? Seriously.)
2. It's only in the case of evidence in court cases. (i.e., you'd have to have a PI license to submit evidence gleaned from a computer HD).
So all you people freaking out, even kiddingly, about not being able to tag -a at the end of your ls commands, you can calm down.
No it doesn't. There is nothing stopping a IT security 'investigator' gaining a PI license, what is being proposed is using existing laws to ensure that the IT security invegtigator are controlled in the same way PI are. The existing PI laws were created to weed out the rouge PIs and how would weeding out the rouge IT investigator be a problem?
Your job is quite safe without getting a PI license. You can dig around and uncover evidence in your network all you like, and you can take normal actions upon that evidence, such as tracing IPs and contacting authorities etc, all the usual stuff. What you can't do is provide what you find in your network as evidence in a court case, that is all. Someone else has to check your place out and then do the testifying themselves. Basically the court does not consider you an accredited expert witness under this legislation. If that is required, a temp PI computer forensic guy can be brought in, collect what is needed, and then he goes somewhere else (he's not into being a network admin, he's got more places to investigate), leaving your position intact.
I would think that requiring an Investigative license for doing invetigative work would be a good thing.
Yes, especially if you want to get paid. Imagine being hired by a company to do some forensic work, and you've found out all kinds of interesting things, and then it makes it to court, and it's all thrown out because you didn't understand and follow basic rules on how to handle evidence, and what's legal and not legal to do.
Good luck getting paid by the employer after losing the case for them. In some jurisdictions you might even face liability or criminal charges.
I've looked into the process, and in some states it's not too bad - IIRC some states require a period of apprenticeship, you can't just take a test.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Yes I do agree that state licensing is rather abysmal. I see where you're coming from. I'm a pathologist. Yet my state medical license states that I can legally practice medicine and surgery (which is rather insane if you ask any reasonable person). On the other hand, there must be some way to say that a particular computer forensics lab is not just some shady operation, especially if the evidence provided is going to be presented in court. Although it shouldn't be a PI license that provides this evidence.
I guess it's too much to expect
It was a cold blustery winter day in Chicago, the kind of cold that chills
McDonalds coffee from "blistering shreds of dangling skin" hot to merely
blistering hot. I downed the last gulp of coffee in my office on the 39th
floor of the Acme building when she walked in the door. A sultry gorgeous
dame, with long billowing blonde hair, and deep green eyes that burned with
angst, and a figure that could pop out eyeballs in a gay bar. I tried to look
her in the eyes but she had a mystique about her, something that told a man
to lower his gaze. I complied with my gut feeling and I wasn't disappointed.
She was to cleavage what Mount Rushmore is to monuments, and in that
second before she spoke, I forgot all about lab reports, stake-out schedules,
and my lost suit at Kim Speedee Dry Cleaning. Her dress was so tight I could
read the J.C. Penny's label on her underware, and I was damned glad for that.
After an awkward moment she spoke. "Mr. Noir, I have a laptop here. I think
my husband has been using the built in web cam to spy on me when he's out
of town...." I had to stop her there. "Just a minute Miss, I don't even know
who you are." And she had the perfect answer when she replied with "I'm
the widow of the late Johann Marstad, owner of Marstad Industries LTD.
I'm Elenor Marstad. Will you look at this computer and tell me what you
find?"
Of course I had to know more. "Where and when do you normally use this
computer?" I asked inquiringly, and once again she didn't disappoint.
"Mostly late at night, in my bedroom." she unhesitatingly answered. My
mission was rather clear. Find the pictures of a stunning beauty, on a
laptop, showing her using it late at night in her bedroom. I'm a licensed
PI so I have the right to do that. It's right there on the license, just
after the part that gives us the right to spy on ordinary Americans, just
before the section that reads "License to argue with Chief of Police."
I was about to take the laptop when my secretary Sally came in...
So, when a copyright violator gets away (or tries to) with unauthorized reproduction of other people's artwork by claiming, she was investigated by an unlicensed investigator, the entire Slashdot is cheering for her. And I only picked the posts moderated at 5...
Other times, we are capable of looking at the requirement with a cooler head and recognize it as worrisome. Even if one accepts, that the classic gun-wielding detectives of the Dr. Watson kind should be licensed (and Dr. Watson was not), it should not be necessary for a computer forensics experts.
Licenses in general are a terrible idea, because they are issued (and revoked!) by the Executive branch with very little recourse from the Courts — in fact, this is why the (Executive) government likes them so much. They allow them to twist the businessmen's arms without the troubles of lawsuits. In the city of New York, for example, a driver can not even appeal a driving citation to the real courts — one's only venue is "Traffic Court", where the "judge" is, in fact, a city employee and part of the Executive branch... (That's right — the separation of powers will not help you, if the government of New York City decides to ban you from the "public" roads.)
Making yet another activity require a license is, indeed, a worrisome development.
In Soviet Washington the swamp drains you.
Various definitions:
http://www.google.com/search?q=define%3Aforensic&submit2=Google
More colloquially one could describe forensics as merely data gathering evidence (whether it be used in a formal court of law or not). A parent using forensics software on a child's computer may not be considered forensics to the FBI, but it probably would be to the parent or child. Much the same for internal company forensics. Strict definitions need to keep up with colloquial usage.
Whether "all car repair shops in NY are honest" or not, the licenses do present a mechanism that can hold them accountable and close them down if sufficient effort is put into enforcement. Licensure can often atrophy into a simple tax collected by a licensing authority that doesn't perform proper enforcement procedures for the licenses it issues, but that's not the idea.
Since a private investigator has a license, he's on the hook if he presents incorrect or bullshit evidence to the court. Ordinarily I can't go to a PI with pictures of my wife and my neighbor taken through open windows, and have him photoshop them into obscene pictures that I can take to court for a divorce proceeding, presented as evidence bearing the imprimatur of a licensed investigation. The court would indeed take that type of evidence more seriously than if you just had some friend of yours photoshop his dick into her mouth himself. That wouldn't be admitted as evidence. The PI has got a license; your friend doesn't. If the PI is indeed found to have violated the terms of his license by doing that, he'll lose his license, and may be subject to fines and jail time in addition to those he'd get for falsification of evidence.
A license if just a scrap of paper that means you paid someone for it. Perhaps you passed a test too. That means about as much as that 10th grade biology final that you crammed for the night before and then erased from your brain after the next morning. I'm much more interested in holding people ACCOUNTABLE for their actions than having the government "protect" me.
A license is not just "a scrap of paper" that required a fee for a licensing authority. After your 12th grade finals are over you may find that scraps of paper can do surprising things. They can imbue you with certain legal responsibilities. If you practice medicine, or practice law, or conduct private investigations, you can do certain things the rest of us can't, and you are on the hook for doing them correctly- you're held ACCOUNTABLE for your actions. Doctors, lawyers, and private investigators each bear their own types of accountability. If you make a legal promise to conduct yourself in some way, and the promise you made then gets "erased from your brain after the next morning", you're going to find yourself in a world of hurt. You'll find it's not like studying for finals at all.
A forensic investigator is gathering information that might certainly be used to put someone in jail. "Oh no, I need a license to do that? Waaah!" Well, duh! What if you're incompetent, or a liar, or the darling of law enforcement because you find child porn on every machine that comes in? Do you really think that type of behavior should be legal, or that evidence from your lab should be admissible in courts?
I don't know what he's complaining about; he stands to gain too. They're trying to make everyone imagine that a handful of film-noir private eyes are planning to take over the computer
The usual, IANAL, this isn't legal advice, etc. etc...
However, I am a current, licensed private investigator in Ohio who happens to do digital forensics from time to time. So, I believe that I can shed some experience (or spread some BS) on this subject.
Private Investigation in Ohio is governed by Ohio Revised Code Chapter 4749. To summarize:
- You have to be a licensed investigator to perform investigations for hire. (Meaning you get paid.)
- The exceptions (and there are specific ones listed) boil down to a) insurance adjustors, arson inspectors, forensic accountants, etc., and b) it's part of your normal job (such as a network administrator tracking down a break-in. My example, not the law's.)
- Anything you do for yourself is, well, for yourself, and doesn't require a license.
A lot of other states have a similar setup.Now, without having read the actual proposed law in South Carolina (this is /., after all), I would say that it sounds like a bad idea. An investigator license is not a magic wand to say that you are an expert, and the summary makes it sound like having a PI license gives you almost automatic "expert witness" status. (From my IANAL point of view, that is a specific determination that the court has to make, and normally they don't take it lightly.
PI licenses are used to regulate who goes around snooping into other people's information. There are specific criminal penalties for performing investigation services, for hire, without a license; I believe that it keeps the people honest (in Ohio, Homeland Security oversees the licensing!), and prevents a lot of wasted time and money on some Magnum wannabe who ends up doing more damage to his clients cases/circumstances than good.
As far as I can tell, those who do purely "digital forensics" are the equivalent of DNA lab techs or fingerprint analysts: They perform a technical function whose methods and findings are narrow, reviewable, and (should be) reproducible. The aspect of "investigation" only comes in when you begin to track down names, background, places, and faces relevant to the process. Despite what CSI: Miami tries to put out, lab guys are not normally the folks interviewing the suspects and poking holes in alibis; they deal with facts and findings. (More like Abbie on NCIS.)
Which leads to the counter-proposal from the Nevada situation: If the courts already have a tried-and-true method of determining what an "expert witness" is, there really isn't a need for another licensing agency. Yes, courts can and do rely on licensing for some determinations, but again, they use experience, knowledge, reproducibility, and accepted methodology as real determining factors. That way, a medical license isn't an automatic "my opinion is indisputable" stamp.
I think South Carolina is either overreacting or trying to pay off a party contributor....but hey, what do I know? (Or, how could I find out? :-)
And yes, I realize that I said I "do computer forensics." Being a geek with a license, it's easier (and much faster and cheaper for the client) to do a forensic run-through myself than to hire it out to a lab every time. But I also know my own limitations, and quickly admit when/if I ever get over my head and need to call in the hard-core experts.
Never confuse movement with action. --Hemingway
From the Code of Virginia:
9.1-138. Definitions.
""Private investigator" means any individual who engages in the business of, or accepts employment to make, investigations to obtain information on (i) crimes or civil wrongs; (ii) the location, disposition, or recovery of stolen property; (iii) the cause of accidents, fires, damages, or injuries to persons or to property; or (iv) evidence to be used before any court, board, officer, or investigative committee. "
and
9.1-139. Licensing, certification, and registration required; qualifications; temporary licenses.
"C. No person shall be employed by a licensed private security services business in the Commonwealth as armored car personnel, courier, armed security officer, detector canine handler, unarmed security officer, security canine handler, private investigator, personal protection specialist, alarm respondent, central station dispatcher, electronic security sales representative, electronic security technician's assistant, or electronic security technician without possessing a valid registration issued by the Department, except as provided in this article."
Note, there is very similar language under New York State laws as well. In fact it's all damn near boiler plate, they are so similar. I would suspect several other states therefore have comparable laws on the books already (No, I have not yet bothered to RTFA). Just because lots of people have been doing it for a while because they were/are ignorant of the law does not excuse it. They are committing a Class 1 misdemeanor. Any decent opposing council will move to exclude any evidence produced by an unlicensed/unregistered company or person.
9.1-149. Unlicensed activity prohibited; penalty.
"C. Any person convicted of a violation of subsections A or B shall be guilty of a Class 1 misdemeanor. "