The Case Against PI Licensing for Digital Forensic Examiners
To many of us, the stereotype of a Private Investigator or PI, conjures up memories of the popular 1980’s television show Magnum, P.I. The weekly series on CBS portrayed the fictional Thomas Magnum living a relatively carefree life as head of security for the estate of fictional author Robin Masters. The image of today’s PI is somewhat different. Most states require that a PI is licensed in the state where he or she practices. Licensing lends credibility and respectability to practitioners in the profession. PIs often work in conjunction with attorneys and insurance companies regarding potential civil and/or criminal litigation to either substantiate or disprove specific case related facts. They are often involved in cases concerning marital infidelity, tracing debtors, technical surveillance countermeasures, finding lost persons and property, anti-fraud work, and so forth. Typically, retired law enforcement professionals put their experience as investigators to practical use by becoming PIs. So, what does all this have to do with a digital forensic examiner?
Over the past year or so, many private sector digital forensic examiners have expressed concern regarding whether or not his or her state requires them to obtain a PI license. At first glance, this appears to be incongruent with the forensic analyses they perform. To say the least, most state PI laws do not directly address digital forensics (computer forensics). Indeed, the laws were written long before digital forensics was even recognized as a forensic science discipline. However, depending upon how certain language in the current laws is interpreted, it can be construed that a digital forensic examiner may need to obtain a PI license. Several states have modified or are in the process of modifying their laws concerning just who can perform digital forensic examinations within the confines of those states. The current scope of most state laws regarding PI licensing has many commonalities. One commonality is the intent of the legislatures of the various states regarding the necessity of licensing PIs. This is typified by Florida law:
The Legislature recognizes that the private security, investigative, and recovery industries are rapidly expanding fields that require regulation to ensure that the interests of the public will be adequately served and protected. The Legislature recognizes that untrained persons, unlicensed persons or businesses, or persons who are not of good moral character engaged in the private security, investigative, and recovery industries are a threat to the welfare of the public if placed in positions of trust. Regulation of licensed and unlicensed persons and businesses engaged in these fields is therefore deemed necessary.1
Another commonality concerns the handling of evidence. This is generally discussed under the definitions section in the various state laws. Typically, language is similar to the South Carolina law:
(A) “Private investigation business” means engaging in business or accepting employment to obtain or furnish information with reference to the:
(4) securing of evidence to be used in a criminal or civil proceeding, or before a board, an administrative agency, an officer, or investigating committee.2
This commonality probably serves as the impetus for licensing digital forensic examiners since they may examine “evidence to be used in a criminal or civil proceeding.” There are also waivers in the various state statutes from the requirement to obtain a PI license for certain individuals. This is typified by California law which exempts:
An officer or employee of the United States of America, or of this state or a political subdivision thereof, while the officer or employee is engaged in the performance of his or her official duties…3
The interpretation from these commonalities is not at all clear. For instance, what constitutes “good moral character” and how is it determined? Why should an employee of a city, county, state, or federal entity be exempt from licensing but his or her counterpart performing the same work in the private sector need to be licensed? Some statutes, such as Michigan’s, attempt to clarify the issues. Computer forensics is actually defined and specifically listed under its PI licensing statute:
(b) “Computer forensics” means the collection, investigation, analysis, and scientific examination of data held on, or retrieved from, computers, computer networks, computer storage media, electronic devices, electronic storage media, or electronic networks, or any combination thereof.
(e) Investigation business means a business that, for a fee, reward, or other consideration, engages in business or accepts employment to furnish, or subcontracts or agrees to make, or makes an investigation for the purpose of obtaining information with reference to any of the following:
(viii) Computer forensics to be used as evidence before a court, board, officer, or investigating committee.4
Some Concerns with Current PI Laws
A listing of the states requiring PI licensing and links to their statutes can be found at www.pimagazine.com/links_Licensing.htm. In reviewing many of the state laws, it is clear that there is no uniformity. Rules vary by state. For instance, some states only require business licenses while others require a specific PI license. Oversight and implementation of PI licensing can be designated to specialized boards mandated by the law or relegated to certain state agencies, police agencies, or other state licensing boards. Clearly lacking is a definitive uniformity of reciprocity. While some states will honor a PI license from another state, others will not. They require licensing within their state before being able to conduct an investigation. Another concern is that some states allow evidence to be introduced into court even if the PI law itself has been violated, 5 presumably in the gathering of that evidence. Equally of concern are the varying qualifications necessary to obtain a PI license, which again, varies from state to state. Three examples are typical of those requirements.
An applicant for an associate or employee registration certificate shall:
1. Be at least eighteen years of age.
2. Be a citizen or legal resident of the United States who is authorized to seek employment in the United States.
3. Not have been convicted of any felony or currently be under indictment for a felony.
4.Within the five years immediately preceding the application for an associate or employee registration certificate, not have been convicted of any misdemeanor act involving:
(a) Personal violence or force against another person or threatening to commit any act of personal violence or force against another person.
(b)Misconduct involving a deadly weapon as provided in section 13-3102.
(c) Dishonesty or fraud.
(f) Domestic violence.
(g) A violation of title 13, chapter 34 or 34.1 or an offense that has the same elements as an offense listed in title 13, chapter 34 or 34.1.
(h) Sexual misconduct.
5. Not be on parole, on community supervision, on work furlough, on home arrest, on release on any other basis or named in an outstanding arrest warrant.
6. Not be serving a term of probation pursuant to a conviction for any act of personal violence or domestic violence, as defined in section 13-3601, or an offense that has the same elements as an offense listed in section 13-3601.
7. Not be either of the following:
(a) Adjudicated mentally incompetent.
(b) Found to constitute a danger to self or others pursuant to section 36-540.
8. Not have a disability as defined in section 41-1461, unless that person is a qualified individual with a disability as defined in section 41-1461.
9.Not have been convicted of acting or attempting to act as a private investigator without a license if a license was required. 6
7526. Before an application for a license is granted, the applicant for a license or his or her manager shall meet all of the following:
(a) Be at least 18 years of age.
(b) Not have committed acts or crimes constituting grounds for denial of a license under Section 480.
(c) Comply with the requirements specified in this chapter for the particular license for which an application is made.
(d) Comply with other qualifications as the director may fix by rule.
7527. The director may require an applicant or his or her manager, to demonstrate his or her qualifications by a written or oral examination, or a combination of both.7
South Carolina law:
(C) Upon receiving the application, bond, and license fee and upon satisfaction after investigation of the competency and integrity and qualifications of the applicant, SLED must grant a license to the applicant to conduct the private investigation business stated in the application.
(E) SLED may issue a license to a person who:
(1) is at least twenty one years of age;
(2) has a high school diploma or equivalent;
(3) is a citizen of the United States;
(4) has not been convicted of a felony or a crime involving moral turpitude;
(5) is of good moral character;
(6) does not unlawfully use drugs;
(7) does not use alcohol to such a degree as to affect adversely his ability to perform competently the duties of a private investigator, has not been adjudicated an incapacitated person without being restored to legal competency, and who has no physical or mental impairment which would prevent him from competently performing the duties of a private investigator;
(8) has not been discharged from the military service with other than an honorable discharge;
(9) has at least three years’ experience:
(a) as a private investigator employed by a licensed private investigation agency;
(b) as an investigator for a law firm, a government agency, a private corporation, a nonprofit organization, or in a capacity that SLED determines has provided the requisite investigative experience; or
(c) as a sworn officer with a federal, state, county, or municipal law enforcement agency. 8
There is also language in many of the laws regarding an employer-employee relationship which exempts an individual from having to obtain a PI license. California law is typical:
7522. This chapter does not apply to:
(a) A person employed exclusively and regularly by any employer who does not provide contract security services for other entities or persons, in connection with the affairs of such employer only and where there exists an employer-employee relationship if that person at no time carries or uses any deadly weapon in the performance of his or her duties.9
Under this clause, as long as the digital forensic examiner (or IT professional) was an employee of a company and all the forensics was performed in-house, PI licensing requirements would not apply. He or she could image hard drives, find probative data, etc., and present the information to management, all without having to obtain a license. However, if the scope of the examination broadened out past the confines of the company’s network and firewall, such as trying to determine the source of a denial of service attack, an interpretation could be made that a license would then become necessary, probably both for the company and the individual. Likewise, under this broad interpretation, an examiner performing any analysis that crosses state boundaries would probably have to have PI licenses in multiple states to ensure that there is no potential violation of laws. The problem raised becomes not knowing where the digital trail will lead, thus, in which states to obtain a PI license. Licensing in multiple states is not a tenable solution.
As written, these laws clearly cannot apply to digital forensics examiners. From the above examples, it appears that it is fairly straightforward to obtain a PI license: be over eighteen, not have a criminal record, not have been adjudicated mentally incompetent, or not use alcohol to the extent that it affects the ability to perform competently the duties of a private investigator. Pertaining to the digital forensics examiner, how are the competency, integrity, and qualifications of the applicant going to be determined? What standards are going to be applied? These are not defined.
Differences between Private Investigation and Digital Forensics
There is a distinct difference between the work performed by a PI and that of a digital forensics examiner. For instance, when a PI is hired to investigate a third-party, the third-party may not be present and may not know that they are under investigation. The PI can observe and record the subject at home or work without notifying the third-party that his or her actions are being documented. The third-party may only become aware of the documentation at the time of litigation, long after the information was gathered. On the other hand, when the digital forensics examiner gathers data and analyzes it for probative value, the data was obtained either with the consent of the owner or through court order (subpoena or search warrant). In both instances, the owner was aware of the investigation and through his or her attorney, had the opportunity to challenge or object in a court of law to its legality and/or admissibility. This fundamental difference between how a PI functions in comparison to how a digital forensic examiner functions is sufficient in itself to preclude digital forensics examiner inclusion under PI licensing statutes. 10
Another question that needs to be asked is why is all the emphasis being placed upon licensing digital forensic examiners as PIs? Should not companies and examiners in the private sector that perform other types of forensic analysis and handle evidence be licensed also? For instance, there are a number of private laboratories that offer forensic DNA analysis services. A review of their websites does not indicate that either the company or any of its staff are licensed. One site lists the states in which its staff members have testified. Included in that listing were the states of Michigan, North Carolina, South Carolina, and Texas, states that appear to be on the forefront in the licensing of digital forensic examiners as PIs. There are a number of other individuals in the private sector performing forensic analysis in the Latent Prints, Questioned Documents, and Firearms disciplines. These individuals handle evidence and also testify in court as expert witnesses. Should the states not also address licensing requirements for other forensic examiners? It appears that digital forensic examiners are being singled out for PI licensing.
Licensing is Not Needed but Accreditation and Certification are Needed
In his article, attorney Joseph J. Schwerha IV clearly articulated that no PI licensing is needed for a digital forensics examiner:
The requirements to become a private investigator largely are inapplicable to the practice of computer forensics. Very few of the states speaking to this area of the law have any requirements for being a private investigator that serve to raise the level of expertise of those practicing computer forensics. Indeed, some of the State requirements serve to eliminate those highly skilled in the Field because the requirements to be a private investigator contain restrictions that have nothing to do with computer forensics. 11
He is not alone in his assessment. The American Bar Association, Section of Science & Technology Law, also addressed this issue. Resolution No. 301 passed the House of Delegates in August 2008. The recommendation discourages states from requiring PI licenses for those engaged in digital forensic (computer forensic) analysis:
RESOLVED, That the American Bar Association urges State, local and territorial legislatures, State regulatory agencies, and other relevant government agencies or entities, to refrain from requiring private investigator licenses for persons engaged in:
- computer or digital forensic services or in the acquisition, review, or analysis of digital or computer-based information, whether for purposes of obtaining or furnishing information for evidentiary or other purposes, or for providing expert testimony before a court; or
- network or system vulnerability testing, including network scans and risk assessment and analysis of computers connected to a network.
FURTHER RESOLVED, That the American Bar Association supports efforts to establish professional certification or competency requirements for such activities based upon the current state of technology and science. 12
In its recent report, the National Academy of Sciences addressed methods to strengthen forensic science. The study was authorized by Congress and the committee took testimony from many experts:
federal agency officials; academics and research scholars; private consultants; federal, state, and local law enforcement officials; scientists; medical examiners; a coroner; crime laboratory officials from the public and private sectors; independent investigators; defense attorneys; forensic science practitioners; and leadership of professional and standard setting organizations.
“The testimonial and documentary evidence considered by the committee was detailed, complex, and sometimes controversial. Given this reality, the committee could not possibly answer every question that it confronted, nor could it devise specific solutions for every problem that it identified. Rather, it reached a consensus on the most important issues now facing the forensic science community and medical examiner system and agreed on 13 specific recommendations to address these issues. 13
Testimony covered many topics and issues including the Digital and Multimedia Analysis discipline (digital forensics/computer forensics). Relevant to this discussion was topic “(h) the accreditation, certification, and licensing of forensic science operations, medical death investigation systems, and scientists.” 14 Of the thirteen recommendations set forth by the committee, one specifically addressed the need for laboratory accreditation and the individual certification of forensic science professionals. The recommendation did not mention the need for licensing of those professionals as PIs:
Laboratory accreditation and individual certification of forensic science professionals should be mandatory, and all forensic science professionals should have access to a certification process. In determining appropriate standards for accreditation and certification, the National Institute of Forensic Science (NIFS) should take into account established and recognized international standards, such as those published by the International Organization for Standardization (ISO). No person (public or private) should be allowed to practice in a forensic science discipline or testify as a forensic science professional without certification. Certification requirements should include, at a minimum, written examinations, supervised practice, proficiency testing, continuing education, recertification procedures, adherence to a code of ethics, and effective disciplinary procedures. All laboratories and facilities (public or private) should be accredited, and all forensic science professionals should be certified, when eligible, within a time period established by NIFS. 15
Licensing of PIs ensures a certain level of accountability and professionalism. However, there is no justification for requiring a digital forensics examiner to obtain a PI license. None of the PI statutes reviewed will do anything to raise the level of competency of the digital forensics examiner (or any other forensic examiner). Rather, there is an entire infrastructure already in place to address this issue, that being the combination of agency accreditation and individual certification.16
Licensing of forensic examiners is not necessary nor is it needed. Those examiners working in an accredited laboratory are already subjected to an entire quality assurance infrastructure that is both internally and externally monitored. A quality assurance system can and does provide the oversight necessary to ensure that the interests of the public are adequately served. The availability of individual certifications for the digital forensic examiner lends another measure of competency. Rather than requiring digital forensic examiners to obtain a PI license, we should focus on the quality assurance aspect of the work performed.
- Florida Law, Title XXXII, Chapter 493, 493.6100 - Legislative Intent.
- South Carolina Law, Chapter 18, Section 401820, Definitions.
- California Law, Business and Professions Code, Section 7522(b).
- Michigan Law, Chapter 338, 338.822, Definitions.
- The Arkansas Private Investigators and Private Security Agencies Act § 17-40-107. Introduction of evidence - Effect of violations. “The introduction of evidence in all courts in Arkansas shall not be affected by violations of this chapter.”
- Arizona Law, Title 32 - Professions and Occupations, Chapter 24 Private Investigators, Article 3 Registration Certificates, 32- 2441. Qualification of applicant for associate or employee registration.
- California Law, Business and Professions Code, Section 7526 and 7527.
- South Carolina Law, Chapter 18, Section 401870, Private Investigation License. (Searching the Code of Regulations of South Carolina on the state web site, http://www.scstatehouse.gov/cgi-bin/query.exe, did not provide any hits on Computer Forensics licensing as of March 4, 2009).
- California Law, Business and Professions Code, Section 7522.
- A more detailed discussion can be found in “Impact of State Licensing of Private Investigators on Digital Forensics, by Joe Howie,
- “Why computer forensic professionals shouldn’t be required to have private investigator licenses.” Joseph J. Schwerha IV, Digital Investigation, 5 (2008) 71.
- http://www.abanet.org/dch/committee.cfm? com= ST202003.
- “Strengthening Forensic Science in the United States: A Path Forward.” Committee on Identifying the Needs of the Forensic Sciences Community; Committee on Applied and
- Theoretical Statistics, National Research Council. (2009). S-2.
- Ibid. S-19.
- “Handbook of Digital and Multimedia Forensic Evidence.” John J. Barbara, Editor. Chapter 3, Certification and Accreditation, Humana Press, November 2007.
John J. Barbara is a Crime Laboratory Analyst Supervisor with the Florida Department of Law Enforcement (FDLE) in Tampa, FL. An ASCLD/LAB inspector since 1993, John has conducted inspections in several forensic disciplines including Digital Evidence. John is the General Editor for the “Handbook of Digital & Multimedia Evidence” published by Humana Press in 2007.