Tuesday, December 23, 2008

PI licenses for forensics: Texas screws the pooch even harder.

I just read this blog posting from Benjamin Wright talking about some decisions made by the Texas Private Security Bureau. Benjamin has been keeping a close watch on this issue in Texas and his input on the subject has been very valuable.

In previous articles, Benjamin has talked about the law in Texas requiring Private Investigator licenses for persons performing digital forensic work and how that law was being used to challenge tickets issued by red-light cameras.

Now the Texas Private Security Bureau has issued a decision that makes it OK for the red-light cameras to operate, but I'm afraid that it muddies the water about who can and cannot perform digital forensics without a PI license. And I have to disagree with Benjamin's conclusion that this is probably a step in the right direction. I have been very clear about my opinion that the whole notion is completely bunk, and this new decision doesn't help the digital forensic field because it allows the government in the state of Texas to sidestep the B.S. that comes with this law, but everyone else still has to shovel it.

I also think that my reading of the decision left me with a different conclusion about the rational that the Bureau used to justify their decision than what Benjamin reported on. The main reason that the Bureau does not see a problem with the red-light cameras is that they are operated by municipalities, and the government is exempt under the Texas law. The Bureau felt that the contractors are only providing ministerial work for the municipalities.

I feel that this decision skirts the intent of the law as it was passed. In theory, the reason this law was passed was to ensure that people's rights were not violated when an untrained, unlicensed person undertook an investigation. If we accept for a brief moment that having a PI license does make you more qualified to perform the investigation then this decision is in essence allowing the government to use unqualified persons to perform digital investigations. I mean, I understand that a police officer is trained in how to gather evidence while protecting people's rights, but these cameras are probably operated by some dude in the IT department. That dude, by the way, has no more forensic qualification than I do. So when a private organization wants to investigate something they need to hire someone with a PI license to protect everyone's rights. But when the government wants to investigate something they don't need to hire someone that has special training on the matter. The libertarian in me is screaming that the people need just as much protection from their government as they do from corporations. The government in Texas can use unlicensed investigators to gather evidence against you, but you need to hire a licensed investigator to counter that evidence.

This decision by the Bureau also leaves us scratching our heads as to how much work an unlicensed investigator can do for the government and still fit the definition of ministerial acts. For example, the red light cameras are simply gathering evidence. Does that mean that acquiring a hard drive image is also simply a ministerial act? What if the investigator takes special steps to gather data from a Host Protected Area or Device Configuration Overlay? Where does it stop?

So I am very disappointed with this decision. By allowing the State government of Texas to avoid the pain of this law, there is a reduced probability that sensibility will prevail and the law will be changed. People in Texas are going to be hiring Sam Spade to do their forensic work and talented IT people who have a passion for technology will be kept out of the business.

No comments: