Slashdot Log In
PI License May Soon Be Required for Computer Forensics
Posted by
ScuttleMonkey
on Fri Jan 04, 2008 08:22 PM
from the geeks-licensed-to-buy-cool-surveillance-gear dept.
from the geeks-licensed-to-buy-cool-surveillance-gear dept.
buzzardsbay writes "The good folks over at Baseline Magazine have an intriguing — and worrisome — report on a movement to limit computer forensics work to those who have a Private Investigator license or those who work for licensed PI agencies. According to the story, pending legislation would limit the specialized task of probing deep into computer hard drives, network and server logs for telltale signs of hacking and data theft to the same people who advertise in the Yellow Pages for surveillance on cheating spouses, workers' compensation fraud and missing persons. Those caught practicing computer forensics without a license could face criminal prosecution."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
License required for PI (Score:4, Funny)
3.141..... (Score:4, Funny)
Worrisome? (Score:5, Insightful)
Re:Worrisome? (Score:5, Insightful)
Parent
Re:Worrisome? (Score:5, Insightful)
Parent
Re:Worrisome? (Score:5, Funny)
Parent
Re:Worrisome? (Score:5, Funny)
Parent
Re:Worrisome? RTFA (Score:5, Informative)
Parent
Re:Worrisome? RTFA (Score:5, Funny)
Parent
Re:Worrisome? RTFA (Score:4, Informative)
I guess it's too much to expect
Parent
Re:Worrisome? RTFA (Score:4, Informative)
Various definitions:
http://www.google.com/search?q=define%3Aforensic&submit2=Google [google.com]
More colloquially one could describe forensics as merely data gathering evidence (whether it be used in a formal court of law or not). A parent using forensics software on a child's computer may not be considered forensics to the FBI, but it probably would be to the parent or child. Much the same for internal company forensics. Strict definitions need to keep up with colloquial usage.
Parent
Re:Worrisome? (Score:5, Insightful)
Parent
Re:Worrisome? (Score:5, Insightful)
Yes, but where do you draw the line? It's easy to say that you can investigate anything from within your company. But what if an attack originates from outside your network, comes across the Internet, and compromises machines on your network. Do you start investigating it internally as "security", and then hand it off to someone else once (presumably licensed) you get outside of your network? If that's the case, then won't the perpetrator have a built-in defense in court by claiming that the "internal" part of the investigation that generated the data that was fed to the "outside" investigator wasn't held to the same forensic standards?
I do see some serious problems with this. Firstly, most PIs are not what I would consider computer forensic experts, computer security experts, or even technology experts. So allowing them to collect forensic data from computers while excluding legitimate computer forensic experts (computer science types) actually lowers the standards. That doesn't make sense. The second problem is that in some states it is not easy to get a PI license, especially if your only investigative training is in computer forensics. Thirdly, because of the global nature of the Internet it means that a forensic investigator who is investigating a compromise in New York may also need to have a PI license in all 49 other states just in case they might have to collect evidence from a system in one of those states. It just doesn't make sense.
Then there's the fact that this law will dramatically reduce the number of people legally allowed to practice computer forensics and testify in court. How does that affect expert witnesses? If you're charged with a computer-related crime and the only 7 firms licensed as PI/Computer Forensic Experts in the state all work with police departments, how do you find an expert witness to rebut their testimony? I can forsee circumstances where a traditional PI with a "point and click" forensics program provides the police with allegedly ironclad evidence that is more full of holes than swiss cheese, and the defendant not being able to discredit/rebut the evidence because their own expert witness isn't licensed in the state.
Parent
A current private investigator geek (Score:5, Informative)
The usual, IANAL, this isn't legal advice, etc. etc...
However, I am a current, licensed private investigator in Ohio who happens to do digital forensics from time to time. So, I believe that I can shed some experience (or spread some BS) on this subject.
Private Investigation in Ohio is governed by Ohio Revised Code Chapter 4749. [ohio.gov] To summarize:
- You have to be a licensed investigator to perform investigations for hire. (Meaning you get paid.)
- The exceptions (and there are specific ones listed) boil down to a) insurance adjustors, arson inspectors, forensic accountants, etc., and b) it's part of your normal job (such as a network administrator tracking down a break-in. My example, not the law's.)
- Anything you do for yourself is, well, for yourself, and doesn't require a license.
A lot of other states have a similar setup.Now, without having read the actual proposed law in South Carolina (this is /., after all), I would say that it sounds like a bad idea. An investigator license is not a magic wand to say that you are an expert, and the summary makes it sound like having a PI license gives you almost automatic "expert witness" status. (From my IANAL point of view, that is a specific determination that the court has to make, and normally they don't take it lightly.
PI licenses are used to regulate who goes around snooping into other people's information. There are specific criminal penalties for performing investigation services, for hire, without a license; I believe that it keeps the people honest (in Ohio, Homeland Security oversees the licensing!), and prevents a lot of wasted time and money on some Magnum wannabe who ends up doing more damage to his clients cases/circumstances than good.
As far as I can tell, those who do purely "digital forensics" are the equivalent of DNA lab techs or fingerprint analysts: They perform a technical function whose methods and findings are narrow, reviewable, and (should be) reproducible. The aspect of "investigation" only comes in when you begin to track down names, background, places, and faces relevant to the process. Despite what CSI: Miami tries to put out, lab guys are not normally the folks interviewing the suspects and poking holes in alibis; they deal with facts and findings. (More like Abbie on NCIS.)
Which leads to the counter-proposal from the Nevada situation: If the courts already have a tried-and-true method of determining what an "expert witness" is, there really isn't a need for another licensing agency. Yes, courts can and do rely on licensing for some determinations, but again, they use experience, knowledge, reproducibility, and accepted methodology as real determining factors. That way, a medical license isn't an automatic "my opinion is indisputable" stamp.
I think South Carolina is either overreacting or trying to pay off a party contributor....but hey, what do I know? (Or, how could I find out? :-)
And yes, I realize that I said I "do computer forensics." Being a geek with a license, it's easier (and much faster and cheaper for the client) to do a forensic run-through myself than to hire it out to a lab every time. But I also know my own limitations, and quickly admit when/if I ever get over my head and need to call in the hard-core experts.
Parent
Re:A current private investigator geek (Score:4, Insightful)
If by "forensic work" you mean autopsying a computer to figure out why/how/when it died or was compromised, then that could fall into your normal work. (Again, I'm talking from Ohio statutes; they leave that exception open. I think this was a reasonable exception, because lots of jobs require some "investigation" to find out what happened.)
If your client/company decides that they even might be filing criminal charges or a civil complaint, then they should, early on, consciously decide how they are going to proceed. If they want an airtight case, or prevent opposing counsel from ripping them and their evidence to tattered little pieces, they have to decide if an in-house investigation is sufficient.
Again, in my opinion (IANAL, blah-blah-blah), figuring out what's on a computer, what happened to it, and even how to prevent it could be considered "digital forensics" but also doesn't require an special licensing. If you start trying to track the people responsible, that's where you start to get into the realm of private investigation, and you should be aware of what your laws require.
As I said, IMHO, "digital forensics" is just like any other lab tech: Specialized knowledge and analysis capability, and an ability to prove your findings to an opposing expert, an attorney, or a court. Beyond that, the South Carolina law/bill seems to be creating an issue where there really shouldn't be one.
Parent
Re: (Score:3, Insightful)
That was my thought. Given the "experts" that groups like the RIAA use, having a license on someone that could be pulled to prevent them from continuing to work in that field seems like a good thing.
Maybe it should be a separate license. Maybe it should be a special add on class (PI + C for Private Investigator + Computer Specialty). But it's good it's SOMETHING. Someone who doesn't know what they are doing can not only cause big problems (enrage a spouse leading to anything from unnecessary worry to viole
Re:Worrisome? (Score:5, Insightful)
We have been trying to figure out how we can become Private Investigators, but we cannot get answers. Instead, we keep getting passed around the government's phone systems. Some say we have to write an exam that doesn't exist, others say that we should be grandfathered in and others simply shrug their shoulders.
From what I can tell, this is just another case of where someone has decided that they want all the market to themselves and think they have found a way to make it happen.
Parent
Courts have rules (Score:4, Insightful)
Yes, especially if you want to get paid. Imagine being hired by a company to do some forensic work, and you've found out all kinds of interesting things, and then it makes it to court, and it's all thrown out because you didn't understand and follow basic rules on how to handle evidence, and what's legal and not legal to do.
Good luck getting paid by the employer after losing the case for them. In some jurisdictions you might even face liability or criminal charges.
I've looked into the process, and in some states it's not too bad - IIRC some states require a period of apprenticeship, you can't just take a test.
Parent
Re: (Score:3, Interesting)
What a load of crap. My job requires us to perform such checks on a regular basis. These requirements are required by Government agencies in order to work on specific projects. Requiring some ridiculous license to read log files will only create a glut of "so called" experts much like all those Windows experts a few years back.
Don't be fooled by this. This is yet another attempt of our Government wanting to control access to knowledge.
Re:Worrisome? (Score:5, Insightful)
Parent
Re:Worrisome? (Score:5, Insightful)
It does. It keeps quite a lot of bad drivers off the road. It just doesn't stop all of them.
If anyone, with no prior knowledge, was allowed on public roads and highways... don't you think things would be much worse than they are now with licenses?
Parent
Re:Worrisome? (Score:4, Interesting)
A license if just a scrap of paper that means you paid someone for it. Perhaps you passed a test too. That means about as much as that 10th grade biology final that you crammed for the night before and then erased from your brain after the next morning. I'm much more interested in holding people ACCOUNTABLE for their actions than having the government "protect" me.
Parent
Re:Worrisome? (Score:5, Insightful)
I don't think anyone should have to worry about investigating their own machine. But what if you are going to trace the attack to the source? At what point does that become hacking? What if you have someone hand you information that has maybe been obtained by dubious methods? In the 1990s nobody knew where the line was drawn.
What happens if you hire someone to do that type of work? Are you going to be liable if they use pretexting or the like?
If Clifford Stoll was using the same techniques today he might well have had some legal issues. Even if you don't break the law you can still ruin the chances of a successful prosecution by contaminating evidence.
I don't want to have people who are working for me acting as vigilantes. I don't want them to collect information in ways that disrupts Law Enforcement efforts. This is a professional business now and we have to act like professionals. People need to understand that there is a line and consequences for crossing it.
Parent
Stop overreacting (Score:4, Insightful)
Whether "all car repair shops in NY are honest" or not, the licenses do present a mechanism that can hold them accountable and close them down if sufficient effort is put into enforcement. Licensure can often atrophy into a simple tax collected by a licensing authority that doesn't perform proper enforcement procedures for the licenses it issues, but that's not the idea.
Since a private investigator has a license, he's on the hook if he presents incorrect or bullshit evidence to the court. Ordinarily I can't go to a PI with pictures of my wife and my neighbor taken through open windows, and have him photoshop them into obscene pictures that I can take to court for a divorce proceeding, presented as evidence bearing the imprimatur of a licensed investigation. The court would indeed take that type of evidence more seriously than if you just had some friend of yours photoshop his dick into her mouth himself. That wouldn't be admitted as evidence. The PI has got a license; your friend doesn't. If the PI is indeed found to have violated the terms of his license by doing that, he'll lose his license, and may be subject to fines and jail time in addition to those he'd get for falsification of evidence.
A license if just a scrap of paper that means you paid someone for it. Perhaps you passed a test too. That means about as much as that 10th grade biology final that you crammed for the night before and then erased from your brain after the next morning. I'm much more interested in holding people ACCOUNTABLE for their actions than having the government "protect" me.
A license is not just "a scrap of paper" that required a fee for a licensing authority. After your 12th grade finals are over you may find that scraps of paper can do surprising things. They can imbue you with certain legal responsibilities. If you practice medicine, or practice law, or conduct private investigations, you can do certain things the rest of us can't, and you are on the hook for doing them correctly- you're held ACCOUNTABLE for your actions. Doctors, lawyers, and private investigators each bear their own types of accountability. If you make a legal promise to conduct yourself in some way, and the promise you made then gets "erased from your brain after the next morning", you're going to find yourself in a world of hurt. You'll find it's not like studying for finals at all.
A forensic investigator is gathering information that might certainly be used to put someone in jail. "Oh no, I need a license to do that? Waaah!" Well, duh! What if you're incompetent, or a liar, or the darling of law enforcement because you find child porn on every machine that comes in? Do you really think that type of behavior should be legal, or that evidence from your lab should be admissible in courts?
I don't know what he's complaining about; he stands to gain too. They're trying to make everyone imagine that a handful of film-noir private eyes are planning to take over the computer
Parent
Already Required in Texas (Score:5, Informative)
Re: (Score:3, Insightful)
A new security measure (Score:3, Funny)
This is good!? (Score:4, Insightful)
"So long as computer forensic specialist implies a PI license" AND NOT "a PI license implies a computer forensic specialist".
Re:This is good!? (Score:4, Insightful)
What if I want to go set up a little computer forensics business and employ my own genius employees that I know and trust? Why should I have to submit to a board comprised of my competitors, deal with licensing requirements which seriously may (now or in the future) risk being outdated, not applicable to many specialized sorts of work, or which provide a false sense of security by being utterly trivial? What happens when the board requires you use Microsoft-certified tools only and bans grep et cetera?
Some economists hold that labor market regulations such as these are among the primary long-term threats that hamper economic growth. (Some places require you to get a license to arrange flowers.)
Parent
Re: (Score:3, Insightful)
Re:This is good!? (Score:5, Funny)
Parent
I don't see the problem (Score:4, Funny)
Not necessarily a bad thing (Score:5, Insightful)
Re:This state has a bad track record with licensin (Score:3, Informative)
Wonder if my Employer would pay for this cert... (Score:3, Informative)
Tm
Re: (Score:3, Informative)
Forensic "work" vs forensic "hobby"? (Score:4, Insightful)
Over hyped (Score:4, Informative)
Hahahah....wooooo, that's a killer (Score:3, Informative)
But most importantly... (Score:3, Funny)
This... (Score:3, Funny)
protectionism... (Score:5, Insightful)
Most states have ridiculous requirements for getting a PI license. You basically can't get one in many states unless you've been a police officer. There is no public interest reason to do this. Requiring the PI license for this is just a gift to all the people who already have PI licenses.
I haven't looked at computer forensics recently, but when I did (roughly five years ago), there were some problems with it. Basically, because of the way that courts certify experts to testify in court, it was impossible to hire a computer forensic expert to work for the defense. It went something like this:
1. To testify as an expert in court, you have to be a member of the leading professional body for your field.
2. The leading professional body of computer forensic experts forbade its members from working for the defense.
Obviously that's problematic. Hopefully it's changed by now.
The other thing I thought was really funny was the way that most computer crime labs staff up with "experts". Rather than hiring people with computer science degrees and training them on how to do police work, they tend to hire police officers and then train them on computer forensics. The good ole boy system at work.
Re:protectionism... (Score:4, Informative)
There are a number of certifications, such as CCE, EnCE and CFCE that are pretty much required for practicing as a forensic examiner. You just aren't going to get anywhere without these. While the certifications seem like BS, what they are useful for is establishing to a non-technical court that you have been both educated and tested in the field. Part of being qualified as an expert witness in court is having your credentials questioned, so if you do not have certifications you will need lots and lots of other information that will need to be as convincing. I've see one person defend their qualifications without much in the way of certifications but it wasn't pretty.
Membership in HTCIA is restricted to law enforcement and law enforcement sponsored people. It does not qualify anyone as a forensic examiner because you do not have to be a forensic examiner to belong - anyone in law enforcement or associated with law enforcement can be a member. They just can't work for the defense. A court that used HTCIA membership as a qualification would be equivalent to a court requiring someone to have contributed to Bill Clinton's legal defense fund to be accepted as a legal expert.
Parent
blame the realtors (Score:3, Insightful)
License required for use in court (Score:4, Interesting)
A guy who comes home and finds his door kicked in does not get to collect finger prints from his house to prove who did it. Frankly, there is no reason why the CEO's nephew should be allowed to pick through a log file like he picks his nose and, upon seeing an IP address with 66.6 in it be allowed to declare 'This is who hacked our computer.'
Yes, it's another unneeded tax, but it's not as bad as the summary makes it sound. Right now, any one can claim to be a computer forensics specialist.
Right. I can see Guy Noir investigating now. (Score:5, Funny)
McDonalds coffee from "blistering shreds of dangling skin" hot to merely
blistering hot. I downed the last gulp of coffee in my office on the 39th
floor of the Acme building when she walked in the door. A sultry gorgeous
dame, with long billowing blonde hair, and deep green eyes that burned with
angst, and a figure that could pop out eyeballs in a gay bar. I tried to look
her in the eyes but she had a mystique about her, something that told a man
to lower his gaze. I complied with my gut feeling and I wasn't disappointed.
She was to cleavage what Mount Rushmore is to monuments, and in that
second before she spoke, I forgot all about lab reports, stake-out schedules,
and my lost suit at Kim Speedee Dry Cleaning. Her dress was so tight I could
read the J.C. Penny's label on her underware, and I was damned glad for that.
After an awkward moment she spoke. "Mr. Noir, I have a laptop here. I think
my husband has been using the built in web cam to spy on me when he's out
of town...." I had to stop her there. "Just a minute Miss, I don't even know
who you are." And she had the perfect answer when she replied with "I'm
the widow of the late Johann Marstad, owner of Marstad Industries LTD.
I'm Elenor Marstad. Will you look at this computer and tell me what you
find?"
Of course I had to know more. "Where and when do you normally use this
computer?" I asked inquiringly, and once again she didn't disappoint.
"Mostly late at night, in my bedroom." she unhesitatingly answered. My
mission was rather clear. Find the pictures of a stunning beauty, on a
laptop, showing her using it late at night in her bedroom. I'm a licensed
PI so I have the right to do that. It's right there on the license, just
after the part that gives us the right to spy on ordinary Americans, just
before the section that reads "License to argue with Chief of Police."
I was about to take the laptop when my secretary Sally came in...
Worrisome! (Score:4, Interesting)
So, when a copyright violator gets away (or tries to) with unauthorized reproduction of other people's artwork by claiming, she was investigated by an unlicensed investigator [slashdot.org], the entire Slashdot is [slashdot.org] cheering [slashdot.org] for [slashdot.org] her [slashdot.org]. And I only picked the posts moderated at 5...
Other times, we are capable of looking at the requirement with a cooler head and recognize it as worrisome. Even if one accepts, that the classic gun-wielding detectives of the Dr. Watson kind should be licensed (and Dr. Watson was not), it should not be necessary for a computer forensics experts.
Licenses in general are a terrible idea, because they are issued (and revoked!) by the Executive branch with very little recourse from the Courts — in fact, this is why the (Executive) government likes them so much. They allow them to twist the businessmen's arms without the troubles of lawsuits. In the city of New York, for example, a driver can not even appeal a driving citation to the real courts — one's only venue is "Traffic Court", where the "judge" is, in fact, a city employee and part of the Executive branch... (That's right — the separation of powers will not help you, if the government of New York City decides to ban you from the "public" roads.)
Making yet another activity require a license is, indeed, a worrisome development.
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Re:what's the problem? (Score:4, Insightful)
Parent