Friday, August 22, 2008

PI Licensing for Computer Forensics

The debate goes on in many states about whether or not Computer Forensics practitioners must be licensed as Private Investigators.

The primary argument for this in most states is twofold:

Requiring a PI license will protect the public interest.

The current law covers computer forensics via the statement:
(v) Securing evidence to be used before a court, board, officer, or investigating committee.

The issue that those of us in the computer forensics field have with this is not whether or not we should be licensed. That would be a step in the right direction in my opinion. However, by lumping us in with PI's, it grants them credibility in our field by holding a license in a totally unrelated discipline, and excludes those who are qualified from practicing in the field until they obtain a PI license.

For instance, Michigan just revamped their licensing law to include computer forensics.
(viii) Computer forensics to be used as evidence before a court, board, officer, or investigating committee.

Honestly, I have no issue with obtaining a PI license in a state that requires one provided that:

The qualifications and experience I have count toward obtaining the license equally with that of private investigators. If you are going to have one law, then the qualifications should be able to be met by experience in any field you lump into the law.

That the law does not but an undue burden on the licensee to do business in that state. Of course, that is relative I suppose, since most states to not seem to have a residency requirement for licensing as long as you post a bond if required and meet the other qualifications for the license.

What is kind of nutty though is that if I obtain a PI license, then I can do anything in their business arena that I want, such as surveillance, investigations, etc.

So the catch 22 is, if I can qualify for a PI license based on my computer forensics experience, the board is potentially unleashing someone with no PI type experience on the public to perform services for which I know I am not qualified.

If a private investigator can perform forensics without any training or experience, then the licensing board is potentially unleashing an equally unqualified person on the public to perform scientific analysis of computer data.

The other part of the quandary is in states that do not require licensing of any kind for computer and cell phone forensics; the public is in a "buyers beware" situation since anyone can hang out a shingle and provide what is a scientific forensic service, even if they have never turned on a computer in their life.

To me, the right answer is to professionally license computer forensics examiners based on a state accepted competency examination, like public engineers or general contractors. Or at the very least requiring a vendor neutral certification from a nationally recognized body such as the Certified Computer Examiner certificate from the International Society of Computer Forensics Examiners.

The wrong answer is to lump what is a forensic science discipline in with a totally unrelated profession without consideration for competency in the discipline.

No comments:

Post a Comment

I have moderated my comments due to spam.