Some Concerns with Current PI Laws
A listing of the states requiring PI licensing and links to their statutes can be found at www.pimagazine.com/links_Licensing.htm. In reviewing many of the state laws, it is clear that there is no uniformity. Rules vary by state. For instance, some states only require business licenses while others require a specific PI license. Oversight and implementation of PI licensing can be designated to specialized boards mandated by the law or relegated to certain state agencies, police agencies, or other state licensing boards. Clearly lacking is a definitive uniformity of reciprocity. While some states will honor a PI license from another state, others will not. They require licensing within their state before being able to conduct an investigation. Another concern is that some states allow evidence to be introduced into court even if the PI law itself has been violated, ⁵ presumably in the gathering of that evidence. Equally of concern are the varying qualifications necessary to obtain a PI license, which again, varies from state to state. Three examples are typical of those requirements.

Arizona law:
An applicant for an associate or employee registration certificate shall:

1. Be at least eighteen years of age.
2. Be a citizen or legal resident of the United States who is authorized to seek employment in the United States.
3. Not have been convicted of any felony or currently be under indictment for a felony.
4.Within the five years immediately preceding the application for an associate or employee registration certificate, not have been convicted of any misdemeanor act involving:

(a) Personal violence or force against another person or threatening to commit any act of personal violence or force against another person.
(b)Misconduct involving a deadly weapon as provided in section 13-3102.
(c) Dishonesty or fraud.
(d) Arson.
(e) Theft.
(f) Domestic violence.
(g) A violation of title 13, chapter 34 or 34.1 or an offense that has the same elements as an offense listed in title 13, chapter 34 or 34.1.
(h) Sexual misconduct.

5. Not be on parole, on community supervision, on work furlough, on home arrest, on release on any other basis or named in an outstanding arrest warrant.
6. Not be serving a term of probation pursuant to a conviction for any act of personal violence or domestic violence, as defined in section 13-3601, or an offense that has the same elements as an offense listed in section 13-3601.
7. Not be either of the following:

(a) Adjudicated mentally incompetent.
(b) Found to constitute a danger to self or others pursuant to section 36-540.

8. Not have a disability as defined in section 41-1461, unless that person is a qualified individual with a disability as defined in section 41-1461.
9.Not have been convicted of acting or attempting to act as a private investigator without a license if a license was required. ⁶

California law:
7526. Before an application for a license is granted, the applicant for a license or his or her manager shall meet all of the following:

(a) Be at least 18 years of age.
(b) Not have committed acts or crimes constituting grounds for denial of a license under Section 480.
(c) Comply with the requirements specified in this chapter for the particular license for which an application is made.
(d) Comply with other qualifications as the director may fix by rule.

7527. The director may require an applicant or his or her manager, to demonstrate his or her qualifications by a written or oral examination, or a combination of both.⁷

South Carolina law:
(C) Upon receiving the application, bond, and license fee and upon satisfaction after investigation of the competency and integrity and qualifications of the applicant, SLED must grant a license to the applicant to conduct the private investigation business stated in the application.
(E) SLED may issue a license to a person who:

(1) is at least twenty one years of age;
(2) has a high school diploma or equivalent;
(3) is a citizen of the United States;
(4) has not been convicted of a felony or a crime involving moral turpitude;
(5) is of good moral character;
(6) does not unlawfully use drugs;
(7) does not use alcohol to such a degree as to affect adversely his ability to perform competently the duties of a private investigator, has not been adjudicated an incapacitated person without being restored to legal competency, and who has no physical or mental impairment which would prevent him from competently performing the duties of a private investigator;
(8) has not been discharged from the military service with other than an honorable discharge;
(9) has at least three years’ experience:

(a) as a private investigator employed by a licensed private investigation agency;
(b) as an investigator for a law firm, a government agency, a private corporation, a nonprofit organization, or in a capacity that SLED determines has provided the requisite investigative experience; or
(c) as a sworn officer with a federal, state, county, or municipal law enforcement agency. ⁸

There is also language in many of the laws regarding an employer-employee relationship which exempts an individual from having to obtain a PI license. California law is typical:
7522. This chapter does not apply to:

(a) A person employed exclusively and regularly by any employer who does not provide contract security services for other entities or persons, in connection with the affairs of such employer only and where there exists an employer-employee relationship if that person at no time carries or uses any deadly weapon in the performance of his or her duties.⁹

Under this clause, as long as the digital forensic examiner (or IT professional) was an employee of a company and all the forensics was performed in-house, PI licensing requirements would not apply. He or she could image hard drives, find probative data, etc., and present the information to management, all without having to obtain a license. However, if the scope of the examination broadened out past the confines of the company’s network and firewall, such as trying to determine the source of a denial of service attack, an interpretation could be made that a license would then become necessary, probably both for the company and the individual. Likewise, under this broad interpretation, an examiner performing any analysis that crosses state boundaries would probably have to have PI licenses in multiple states to ensure that there is no potential violation of laws. The problem raised becomes not knowing where the digital trail will lead, thus, in which states to obtain a PI license. Licensing in multiple states is not a tenable solution.