Thursday, April 9, 2009

On the Topic of Licensing Forensics Specialty Professionals, Including Computer Forensics Professionals as Private Investigators.

This is the position paper I wrote on this topic when North Carolina began considering requiring Private Investigator licenses for computer forensics. I decided to post it here, in its entirety, so people would be able to understand my stance on this issue.

You can download this document in PDF format from my website at Position Paper



On the Topic of Licensing Forensics Specialty Professionals, Including Computer Forensics Professionals as Private Investigators.
Introduction:
Licensing for Digital Forensics Professionals and other forensics specialties is the right and proper course of action to take at this time. However, licensing these specialty professionals as Private Investigators would be detrimental to both professions.
Right now the Private Protective Services Board has an opportunity to create new rules and amendments to the current licensing legislation that would be of great service to the people who need and contract for these services. As many states are currently dealing with the same legislative issues, the North Carolina Private Protective Services Board has an opportunity to create legislation that could serve as a badly needed model for other states to follow as well.
However, defining the new legislation too broadly or too narrowly would be a disservice to the consumers of specialty forensics services by either excluding qualified forensics professionals from practicing or allowing unqualified persons to provide forensic specialty services without the proper training and expertise.
The issue at hand is whether or not Digital Forensics Professionals or specialty forensics professionals should be licensed as Private Investigators.
The language in the current legislation would seem to support that specialty forensics professionals should be licensed as Private Investigators since it is possible for them to perform some services that would overlap what is traditionally considered private investigation:
1. Obtaining evidence for use in a court of law.
2. Interviewing persons related to the matter at hand.
3. Presenting evidence in a court of law.
While there is some overlap in what forensic specialties professionals may do in the course of providing their specific services, there is no overlap in the required expertise to perform scientific and technical forensics services once you leave the realm of the three items mentioned above.
Therefore, it is imperative that separate and distinct licensing should be required for persons who wish to engage in providing computer or digital forensics services and other specialty forensics services. Such licensing should be exclusive to forensics professionals and not be considered a subset the Private Investigators license nor should holding a Private Investigators license be considered a prerequisite to hold a specialty forensic license.
It is clear that the licensing for forensics specialties should be separate from the umbrella of the Private Investigators license for the following reasons:
1. The experience and training for forensics specialties that are not covered by professional state licensing boards, should be included in the provision. This would include persons engaging in handwriting analysis, computer forensics, DNA analysis and other non-regulated forensics science activities. It is surprising to learn that even DNA analysts are not required to have state licenses to perform forensic DNA analysis.
2. The possibility of doing harm to a person through lack of expertise increases as the level of required expertise exceeds that of laymen and non-specialists in the field.
3. The need for qualified expert witnesses on both sides of a case to ensure that persons receive the best ligation support possible. When it is not possible for a person to retain the services of a qualified expert, it creates an unfair advantage for the other side in both civil and criminal proceedings.
4. While the court is the ultimate determiner of who may qualify as an expert witness; if unqualified individuals are allowed to practice, harm may come to persons long before the issue of qualifications of an expert is brought before a judge.
5. While the expertise in investigations is inherent in what constitutes a Private Investigator, expertise in investigating technical and scientific data is not and should not be allowed to be assumed by holding a Private Investigators license..
A Proposed Framework for Licensing Requirements for Computer and other Specialty Forensics Professionals:
1. Forensics Specialty Professionals must have and maintain Errors and Omissions insurance in addition to standard liability insurance.
2. Applicants must pass a criminal background check.
3. Certification from a nationally recognized certifying body is required. (In the case of computer forensics professionals, the Certified Computer Examiner issued by the International Society of Forensics Computer Examiners is the most widely recognized vendor neutral certification. It is important to note here that this certification does not cover Cell Phone Forensics, another specialty for which there is no certifying body at present.)
4. A minimum of 80 hours of training in the specific specialty by a nationally recognized vendor.
5. A minimum of 3 years of full time employment providing forensics specialty services in the field for which a license is desired. Client references and employment history must be documented.
6. A 4 year degree in the area of specialization can be substituted for two years of experience. A 2 year degree in the area of specialization can be substituted for 1 year of experience.
7. An associate license can be issued in lieu of a full license to persons entering the specialty field providing they meet the minimum certification requirements, 80 hours of specialty training and are employed full time under the supervision of a licensed specialty forensics professional.
8. A minimum 15 hours training per year by a nationally recognized vendor in the specialty field is required to maintain a Specialty Forensics License.
Dealing with the overlap between specialty forensics professionals and Private Investigators:
1. Anyone who acquires original evidence must comply with the state and federal rules of evidence and accepted standards for the specialty forensics services provided.
a. In the case of computer forensics, the standard is set forth by the US Department of Justice, Federal Bureau of Investigation, and other government agencies that have created specific guidelines’ for the handling, acquisition and preservation of fragile digital evidence.
b. Improper handling of digital evidence can render it useless in court.
c. Proper chain of custody must be maintained and documented.
2. Interviewing persons involved in the matter at hand is sometimes required in the course of performing the services of the specialty forensics professional. However, there is no need for the specialty forensics professional to perform classical investigative interviews or surveillance of persons.
3. Presentation of evidence in a court of law in the specialty field is what should be focused on here, where the person providing the testimony would normally be required to qualify as an expert in the field. It would be counter productive for a specialty forensics professional to testify as to the general investigation of the matter at hand as it would also be counter-productive for a non-specialized investigator to present and testify to the validity of evidentiary findings in an expert area.
To wit, under the licensing provisions for specialty forensics professionals, limited investigative activities should be allowed where such activities are required to perform the specific tasks associated with the specialty. This would reflect the model used by the NC Refrigeration License where license holders are granted a limited electrical license to perform the duties of the specialty.
1. Acquisition of original evidence:
a. The gathering of original evidence specifically as required to meet the needs of the specialty for examination and analysis would be allowed.
i. Forensically imaging digital evidence such as hard drives and other digital storage devices by qualified digital forensics professionals. (Digital Forensics Only)
ii. Acquisition of handwriting samples for the purpose of handwriting analysis.
iii. Collections of paper documents for the purpose of document analysis.
iv. Collection of DNA samples by qualified DNA analysts.
2. Interviewing persons involved directly in the course of the specialty analysis.
3. Presentation of findings in a court of law as an expert in the specialty field, providing the court recognizes the person as a qualified expert.
4. Analysis of evidence lawfully obtained by others such as cell phone record analysis for GPS positioning purposes, DNA samples, handwriting samples, digital devices, etc.
Jurisdictional Issues:
Dealing with the needs of national companies, law firms and other entities that may need to collect, analyze or present evidentiary findings in North Carolina could be addressed by allowing the issuance of temporary licenses. However, this would put an undue burden on the Private Protective Services Board to investigate and issue such licenses.
A better solution would be to simply required specialty professionals to acquire a license in North Carolina under the standard licensing requirements of other Specialty Forensics Professionals. Otherwise they would need to hire a licensed North Carolina Specialty Forensics Professional to perform the work. Either scenario would benefit North Carolina in the long run and protect the residents from unscrupulous and unqualified practitioners from providing services in the state.
Summary:
It is clear and important that specialty forensics professionals be licensed and held to appropriate standards for operating a forensics business in the State of North Carolina.
It is also clear that requiring specialty forensics professionals to obtain and hold a Private Investigators license would put an undue burden on said professionals since many of them have no intention of providing Private Investigation services, do not have the appropriate background to do so and cannot suspend the activities of their current practices to obtain such a license by entering a field outside their area of expertise.
It is also clear that having Private Investigators, simply by virtue of holding a license, practice in area outside of their expertise would be detrimental to the persons and firms requiring the services of qualified experts and would be a disservice to the constituents in the state of North Carolina.
It is also clear that restricting the ability of persons to obtain the services of qualified experts would create an imbalance of justice where evidence may be collected and presented as facts where an opposing expert cannot be obtained. This is especially harmful to persons charged with crimes who may not be able to mount an adequate defense if they must depend on persons who are not qualified in the field or must rely solely on the statement of facts provided by the prosecution.
There is a clear danger to the residents of North Carolina of allowing persons to operate as computer forensics or other specialty forensics professionals without proper licensing and oversight by the Private Protective Services Board.
Reasonable and proper standards must be set for the qualification, licensing and oversight of computer forensics and other specialty forensics professionals as professionals in their field and not as Private Investigators.

No comments:

Post a Comment

I have moderated my comments due to spam.