Follow-up On Texas PI Law For PC Techs

boyko.at.netqos writes "Network Performance Daily has put out an in-depth series on the Texas law that requires private investigator licenses for computer repair techs, network analysts, and other IT professionals. It includes an interview with the author of the law, Texas Rep. Joe Driver, the captain of the Texas Private Security Bureau, RenEarl Bowie, and Matt Miller at the Institute for Justice, which is suing the state over the law. Finally, there's a series summary and editorial."

Comments

Your Stupidity at Work.

[fm6]

Read. The. Fucking. Article. A computer tech only has to be a PI if they are searching a computer for evidence of a crime.

Re:Your Stupidity at Work.

[geekoid]

And the quote is wrong.
"
                          (b) For purposes of Subsection (a)(1), obtaining or
            furnishing information includes information obtained or furnished
            through the review and analysis of, and the investigation into the
            content of, computer-based data not available to the public.
"
Subsection (a)(1):
"
                      (a) Unless the person holds a license as a security services
            contractor, a person may not:
                                      (1) act as an alarm systems company, armored car
            company, courier company, guard company, [or] guard dog company,
            locksmith company, or private security consultant company;"

http://www.legis.state.tx.us/tlodocs/80R/billtext/html/HB02833F.htm

What we have 'ere is, failure to communicate.

Someone took a piece of the bill, misunderstood it's meaning.

Re:Your Stupidity at Work.

[Obfuscant]

I did RTFA. And yes, the law was intended to work that way. Unfortunately, that's not what the law says.

Yes, that IS what the law says. It is reasonably clear. If you are in the BUSINESS of investigating criminal acts, you need a PI license. Computer techs, unless working for a company that is in the BUSINESS of such investigation, are NOT in the business of investigating criminal acts.

That's what the author of the law said. That's what the licensing bureau chief said.

And since almost any work on a computer involves investigating data on that computer not accessible to the public (the user's firewall settings, for example, aren't available to the public), any such work falls under the "investigation" part and requires a PI license.

The section of the law that refers to "computer data not available to the public" applied only to the section of the law that defines who needs a license. It does NOT, by itself, create a new class of people who need a license. Looking at data "not available to the public" does not automatically mean you need a PI license. If you are not IN THE BUSINESS OF investigating the listed criminal or civil acts under the first section, it does not matter if what you are looking at is data "not available to the public".

The guy who enforces this law went as far as to say that a network tech who looks for a slowdown in performance and finds a virus or "theft of intellectual property" is NOT subject to this law, even though the virus may be the result of a criminal act, or the IP theft result in civil litigation.

The guy who wrote the law says computer techs are not required to have a PI license. The guy who enforces the law says they are not required to have a PI license. The LAW lists who is required to have a PI license, and "computer repair tech" is NOT in that list.

This is a publicity stunt to get money for this new institute, trying to scare people into giving them money to defend against something that a simple reading of the law -- the WHOLE law and not just one sentence -- would tell them doesn't apply to them.

And the law will be enforced based on what it says, not on what anyone thinks it should have said instead.

The person who is responsible for enforcing the law has said how it will be enforced, and people who repair computers are NOT on the list.

Stop spreading FUD. There are more important things to spend time on. There is no story here.

Re:Your Stupidity at Work.

[Obfuscant]

Actually, none of the bill you just quoted states anything about WHY the data is being reviewed or analyzed...

YES, IT DOES. Yes, I'm shouting. Stop ignoring the section of the law specifically referred to by the "data not available to the public" clause. "For the purposes of" a specific section means that applies ONLY TO THAT SECTION.

Sec. 1702.104. INVESTIGATIONS COMPANY. (a) A person acts as an investigations company for the purposes of this chapter if the person: (1) engages in the business of obtaining or furnishing, or accepts employment to obtain or furnish, information related to: (A) crime or wrongs done or threatened against a state or the United States; (B) the identity, habits, business, occupation, knowledge, efficiency, loyalty, movement, location, affiliations, associations, transactions, acts, reputation, or character of a person; (C) the location, disposition, or recovery of lost or stolen property; or (D) the cause or responsibility for a fire, libel, loss, accident, damage, or injury to a person or to property;

THAT is a list of the reasons relevant to the collection of the data mentioned in:

(b) For purposes of Subsection (a)(1), obtaining or furnishing information includes information obtained or furnished through the review and analysis of, and the investigation into the content of, computer-based data not available to the public.

The law speaks about being, first, IN THE BUSINESS OF investigating, not the business of repairing broken computers. Second, it lists the things being investigated. "Why this computer crashed" is NOT in that list. It doesn't matter if the answer is "because the owner clicked on a malware-loaded kiddie porn site", because the computer repair tech is not trying to learn if the owner clicked on a malware-loaded kiddie porn site or not, he's looking for why the computer crashed.

IF you are IN THE BUSINESS of investigating the list of crimes or civil infractions listed in the law, AND you are recovering, analyzing, AND INVESTIGATING computer data that is not available to the public towards THAT END, you need a PI license. Anything else is NOT covered by this law.

THAT is what the author says, that is what the enforcer says. End of story.

Re:Your Stupidity at Work.

[ptbarnett]

Someone took a piece of the bill, misunderstood it's meaning.

No, you read the bill incorrectly: the misunderstanding is yours.

It's a bit mis-formatted, so you missed which section (a)(1) it was referring to.

The correct reference is:

Sec. 1702.104. INVESTIGATIONS COMPANY.

(a) A person acts as an investigations company for the purposes of this chapter if the person:

(1) engages in the business of obtaining or furnishing, or accepts employment to obtain or furnish, information related to:

(A) crime or wrongs done or threatened against a state or the United States;

(B) the identity, habits, business, occupation, knowledge, efficiency, loyalty, movement, location, affiliations, associations, transactions, acts, reputation, or character of a person;

(C) the location, disposition, or recovery of lost or stolen property; or

(D) the cause or responsibility for a fire, libel, loss, accident, damage, or injury to a person or to property;

[....]

(b) For purposes of Subsection (a)(1), obtaining or furnishing information includes information obtained or furnished through the review and analysis of, and the investigation into the content of, computer-based data not available to the public.

If you don't believe me, look at the statute, as amended:

http://tlo2.tlc.state.tx.us/statutes/docs/OC/content/htm/oc.010.00.001702.00.htm#1702.104.00

Subsection (a)(1)(B) casts a really wide net, when combined with the subsection (b) that was added. It's basically defining what constitutes an "investigations company", and a literal interpretation of the law as written could apply to a lot of people that aren't investigating a crime.

Yes, I know the state agency says that wasn't the intention. But, they didn't write the law. And while there are legal doctrines that provide some protection (look up "equitable estoppel"), it can be an expensive day in court to prove you were not breaking the law.

Over Reaction

[twiddlingbits]

Follow the links and read the law yourself. The context is PC Techs in the Forensics or Private Security business domains, NOT PC Techs in general. The Geek Squad at Best Buy isn't going to have to get PI Licenses nor is Joe Coder but the techs at Joes PI and Divorce Lawyer Shack would if he ever wants to do any work involving electronic media containing private info. For instance if your wife wants to know the details of your Porn collection as part of the divorce her PI or lawyer would need licensed techs. That's not a bad thing. But it's just going to drive legal costs up which will have an effect (small) on other prices. Reading the law I'm not sure if a corporate internal fraud or forensic techs (to find out about your MP3 collection on the work SAN) or those performing consulting services will need licenses or not. Probaby not as one clause in the license allows work to be supervised by a license holder so that may be the loophole. Just make sure your Chief Security Officer has a PI license. I agree the law needs some clarification but that can be left to the discretion of the court as to what the intent was (risky move) or someone can lobby the Texas legislature to update the law. In the meantime I seriously doubt anyone is going to be rushing to apply the law to everyone who MAY do PC work.

Re:Courts

[Obfuscant]

Now instead of the IT dept (me) querying our email archival system or exporting PSTs from users mailboxes, we now have to hire a PI who knows absolutely nothing about our network,...

That is not what the law says, unless you, specifically, are IN THE BUSINESS of investigating crimes and for that purpose collect, analyze, and INVESTIGATE the data that is not generally available to the public.

You aren't. You are in the business of running a computer network. That is what you were employed to do. This section of the law does NOT APPLY TO YOU.

I live in Texas and I am calling my rep over this.

Perhaps you should ask him about the modem tax while you've got him on the line.

Texas PI License requirements create Mobius loop

[Ruthless Evolution]

Being located in Texas working for an organization as the CSO/CISO with 24+ years experience in the computer industry doing nearly every job including CIO, earned my CISSP/ISSAP/ISSMP in 2000, pro bono work for the Dept of Homeland Security and directing a team of IS, network and infosec professionals, I am concerned about the ramifications of this new law. By one interpretation, my teams would be indemnified while doing their forensics and analysis work if I am licensed as a PI in Texas. Although a burden none of us particularly wants, I began researching what is necessary for the license. From what I have been able to find, I can apply for the license, however it requires a "Company Name and License Number"; basically requiring me to be employed by a licensed investigations company to apply. Additionally, to qualify for a "manager" PI license, I need to maintain supervisory employment with a sponsoring licensed investigations company on a "daily basis" or forfeit my license. So, to act as a manager overseeing the forensic, investigative and analysis activities of my PC techs, network engineers, developers, and certified infosec employees (many of whom are ex-military intelligence), I must hold a Texas manager PI license; however I cannot work for a non-investigative company to maintain that license or even obtain an individual PI license. A legal Mobius loop created by a clueless "insurance salesman" that repeatedly states that the issues this creates are beyond his comprehension running the Texas State committee on law enforcement as a state representative. Very frustrating.

I-75

[falconwolf]

I work for one of the many telecom companies along I-75 in Dallas

Sorry but I-75 runs between Michigan and Florida and comes no where near Texas. I've lived in both states and have traveled the whole thing a number of tymes. What's in Dallas maybe something75 but not I-75 ("I" meaning Interstate and part of the interstate highway system).

Falcon

Re:Tax Dollars At Work

[Amarok.Org]

Certainly within Texas, there's what's known as the "mandatory reporter" law. For certain offenses, child abuse and child pornography among them, all persons are considered mandatory reporters. If you are aware of the offense, you are required by law to report it. Failure to do so is a criminal offense.

For other types of crimes (typically non-violent or not involving children), the mandatory reporting requirement applies only to particular agencies or classes of individuals. But in the case of child abuse or child pornography, every single person in the state is a "mandatory reporter".

Many other states have similar laws. I am familiar with Texas and California, as I have family and friends who work (or have worked) in the child protective agencies of those states.

Re:Tax Dollars At Work

[Amarok.Org]

Citation: http://tlo2.tlc.state.tx.us/statutes/docs/FA/content/htm/fa.005.00.000261.00.htm

Texas Family Code, Chapter 261, Subchapter B, Section 101.

Reference

[tinkerghost]

Reference Here