dc0de wrote:

For those of you who care about Computer Forensics, please see the current situation in Georgia.

There is a bill before the GA Legislature -- HB 1259

If passed, it will make it a Felony to perform and testify in a State Court about any computer forensics performed, unless you are a licensed Private Investigator.

This law will put honest, local companies out of business, unless they go and get licensed. Note, the GA requirements for a Private Investigator have NO REQUIREMENTS to have ANY computer forensics expertise, nor is there any training regarding how to collect the evidence.

Several other states already have these laws, which only allows Licensed private investigative services company to perform and testify to any computer forensics related evidence. (Note, this would also include any IT Audit records, not specifically limited in any way to performing "Encase" like hard drive forensics.)

If you live in GA, please contact the Govenor and ask that he VETO HB1259.

I have not been following this issue or had a chance to look into it in any depth.. I look forward to more information getting posted. This is something computer security professionals should pay attention to.

Update: Here is some more information. dc0de posted up an email he got from John Roberson of The Georgia Association of Professional Private Investigators, Inc. (GAPPI) (BYLAWS) (BoD) (CoE)

dc0de makes two observations which I find to be very accurate:

1. The fact that I have this email shows how little these people know about computer security and forensics.

2. The fact that they use a "secure" Yahoo Group to keep their members up to date, makes me chuckle as to what LITTLE prowess they have on the entire topic of Computer Security.

Again, I have not looked into this subject any length, so I can play the open minded guy, even though I'm pretty much positive which way this one is going to go. I see an attempted power grab taking place by some folks not worthy of that power. Locking the people who understand computer security out of the court system is not going to play over well with anyone who is has the ability to take a top down look at the situation from the perspective of global, national, state, or corporate security.

Update2: Read this about becoming a private investigator in Georgia, as compared to getting certified CISSP or EnCE. Ask yourself what is more relevant in a court situation, as it is the discourse which should be taking place.

Here's some more interesting information...

The below email was sent out by the current president of the Georgia Assoc. of Professional Private Investigators.

1. The fact that I have this email shows how little these people know about computer security and forensics.

2. The fact that they use a "secure" Yahoo Group to keep their members up to date, makes me chuckle as to what LITTLE prowess they have on the entire topic of Computer Security.

However, I ask that you read what Mr. Roberson wrote, as I have not modified any of the text below, except to remove the html links that cannot be posted on memestreams.

----------------------------------------------
From: "John Roberson" john.jri@gmail.com
To: GAPPI gappinews@yahoogroups.com
Date: Fri, 21 Apr 2006 04:56:56 -0400
Subject: [GAPPINEWS] Help still needed for HB-1259

There has been no change in HB-1259, it is still on the Governor's desk. That means we still need calls to his office to encourage him to sign the bill this year. The telephone number is (404) 656-1776, so call as soon as you read this message. You also need to contact five others to get them to call also. They don't have to be private investigators, just regular folks like your mother, father and other friends and relatives. It is very important to our industry. If you have keep up with state and national legislation over the past five years we are losing ground every year, and pretty soon our industry will be eroded away. Let's begin the fight now so as not to lose any more ground. Thanks for your participation.
--
John Roberson Investigations
Atlanta, GA 1-800-325-0914
706-301-5687 john.jri@gmail.com
Georgia PI license # PDC 000680
Please restrict your post to news that are of interest to GAPPI members. All messages are required to have the name and company name of the sender or they will not be approved. If you enjoy it ask your fellow GAPPI members to join GAPPINEWS.

----------------------------------------------

It would seem that I don't need to join GAPPINEWS to read the news... sad... but true.

----------------------------------------------
Here are some additional notes:

If passed this law will make it a felony for anyone in the following fields, computer forensic, CPAs, Forensic Accountants, Doctors, Civil Engineers, Valuation Companies, Forensic Software Companies, from practicing their trade, without being charged with a felony.

Also note, Wombat emailed me the following:

From: wombat [yeah-you-wish@go.away.and.spit.org]
Sent: Friday, April 21, 2006 8:26 PM
To: dc0de
Subject: Re: FW: FWD: [GAPPINEWS] Help still needed for HB-1259

I hear texas has a law already; I know nevada does (which is cute, as I read it, we're all breaking the law by discussing security at trade shows in Las Vegas, e.g. Black Hat when training) is the forensics certification stuff that's out there, for computer professionals, relevant to this? (i.e. EnCE, and others)

dc0de wrote:
Here's some more interesting information...

...

Also note, Wombat emailed me the following:

From: wombat [yeah-you-wish@go.away.and.spit.org]
Sent: Friday, April 21, 2006 8:26 PM
To: dc0de
Subject: Re: FW: FWD: [GAPPINEWS] Help still needed for HB-1259

I hear texas has a law already; I know nevada does (which is cute, as I read it, we're all breaking the law by discussing security at trade shows in Las Vegas, e.g. Black Hat when training) is the forensics certification stuff that's out there, for computer professionals, relevant to this? (i.e. EnCE, and others)

Why hasn't this hit se2600 and the other mailing lists yet?

Rattle wrote:

dc0de wrote:

For those of you who care about Computer Forensics, please see the current situation in Georgia.

There is a bill before the GA Legislature -- HB 1259

If passed, it will make it a Felony to perform and testify in a State Court about any computer forensics performed, unless you are a licensed Private Investigator.

This law will put honest, local companies out of business, unless they go and get licensed. Note, the GA requirements for a Private Investigator have NO REQUIREMENTS to have ANY computer forensics expertise, nor is there any training regarding how to collect the evidence.

Several other states already have these laws, which only allows Licensed private investigative services company to perform and testify to any computer forensics related evidence. (Note, this would also include any IT Audit records, not specifically limited in any way to performing "Encase" like hard drive forensics.)

If you live in GA, please contact the Govenor and ask that he VETO HB1259.

I have not been following this issue or had a chance to look into it in any depth.. I look forward to more information getting posted. This is something computer security professionals should pay attention to.

Its not difficult at all to become a private investigator, if this does pass.

Jello wrote:

Its not difficult at all to become a private investigator, if this does pass.

Well, the point is this -

1. To become a P.I. in GA, you don't ever have to take ANY classes on computer forensics

2. This law will make it illegal for Delloitte to perform many of their computer security services without breaking the law.

3. Those people who have already testified in GA courts and have been ACCEPTED as expert witnesses in computer forensics will be breaking the law if this passes.

4. The requirements for a PI is to have at least one licensed PI with a criminal justice degree... again, NOTHING to do with computer forensics.

While it might not be "hard" to get a license, there is a reason that a majority of the Forensics companies have not gotten them to date. They are not condusive to getting contract work, as a PI is not educated in Computer Forensics processes and procedures, where an EnCE certified computer forensics expert (for example), IS trained specifically in the gathering of evidence from digital assets.

I think that by limiting the responsibility for computer forensics to a group of people that have no clear credentials in computer forensics will further erode the capability to bring computer based criminals to justice. The majority of the PI's that I know, clearly admit that they have NO IDEA how to collect computer evidence. One of them recently stated to me, "I think this law is patently stupid, and I'm a licensed P.I. in the state".

While it might not be Hard to get a PI license, it shouldn't be necessary. PI's and Computers don't mix...

dc0de wrote:

Jello wrote:

Its not difficult at all to become a private investigator, if this does pass.

Well, the point is this -

1. To become a P.I. in GA, you don't ever have to take ANY classes on computer forensics

2. This law will make it illegal for Delloitte to perform many of their computer security services without breaking the law.

3. Those people who have already testified in GA courts and have been ACCEPTED as expert witnesses in computer forensics will be breaking the law if this passes.

4. The requirements for a PI is to have at least one licensed PI with a criminal justice degree... again, NOTHING to do with computer forensics.

While it might not be "hard" to get a license, there is a reason that a majority of the Forensics companies have not gotten them to date. They are not condusive to getting contract work, as a PI is not educated in Computer Forensics processes and procedures, where an EnCE certified computer forensics expert (for example), IS trained specifically in the gathering of evidence from digital assets.

I think that by limiting the responsibility for computer forensics to a group of people that have no clear credentials in computer forensics will further erode the capability to bring computer based criminals to justice. The majority of the PI's that I know, clearly admit that they have NO IDEA how to collect computer evidence. One of them recently stated to me, "I think this law is patently stupid, and I'm a licensed P.I. in the state".

While it might not be Hard to get a PI license, it shouldn't be necessary. PI's and Computers don't mix...

I'm confused about what you mean about the criminal justsice class. I know people who've gotten PI licenses and it was quite easy. Do you mean that a consulting firm would have to have someone with a criminal justice degree on board?

In the state of Georgia, you are not the licensed PI. The Company provides your license.

In order to act as a licenced PI you have to work for a company that can "cover" you with their license. In order for the comapany to be allowed to "cover" you, you have to have prior law enforcement training OR a 4 year Criminal Justice degree.

See this link

http://www.sos.state.ga.us/plb/faqs/31%20faqs.htm

Hey Rattle, thanks for the heads up on this one. I have reposted the information on my blog and have sent the Governor a letter. I am sending an email out to the Security Officers I work with in Georgia right now. If I am in town, I will be at the next HTCIA meeting.

Hey Rattle, thanks for the heads up on this one. I have reposted the information on my blog and have sent the Governor a letter. I am sending an email out to the Security Officers I work with in Georgia right now. If I am in town, I will be at the next HTCIA meeting.

No problem. Be sure to let us know how it goes.

It is highly likely press will be there. Take any opportunities to speak to them and share the computer security/forensics perspective on the issue.

dc0de wrote:

For those of you who care about Computer Forensics, please see the current situation in Georgia.

There is a bill before the GA Legislature -- HB 1259

If passed, it will make it a Felony to perform and testify in a State Court about any computer forensics performed, unless you are a licensed Private Investigator.

Here is some more discussion of the issue. Here is the actual text of the legislation. The Atlanta High Technology Crime Investigation Association is holding a meeting on this subject on May 8th. Calvin Hill, Representative who sponsored the bill, and John Villanes, Chairman, Georgia Board of Private Detectives will be at the meeting.

I heard California has it too...So I wonder if Delloitte has the same fight there? Or do they pratice here to get around it?

The GA barbers have licenses too...Gee. The girl that cuts my hair has a license...

Bits&Bytes wrote:
The GA barbers have licenses too...Gee. The girl that cuts my hair has a license...

Yeah, but if you cut somebody's hair without a licence they don't throw you in prison for 2 years.

Decius wrote:

Bits&Bytes wrote:
The GA barbers have licenses too...Gee. The girl that cuts my hair has a license...

Yeah, but if you cut somebody's hair without a licence they don't throw you in prison for 2 years.

True...but she doesn't come in contact with social security numbers or bankk information and my hair will grow back. ID theft is hard and expensive to recover from.

Bits&Bytes wrote:
True...but she doesn't come in contact with social security numbers or bankk information and my hair will grow back. ID theft is hard and expensive to recover from.

1. This rule change has nothing to do with identity theft.

2. Any common computer consultant, such as a DBA or systems administrator, would have just as much access to personal information as a computer forensics person. These people are not licensed, by this rule or any other rule.

3. Computer forensics people are generally called in after a breakin has taken place. At that point any personal information on the computer is already compromised.

4. Licensing computer forensics people wouldn't prevent them from commiting identity theft. The reason that we license private investigators is to ensure that they are properly trained with regard to the rules about wiretapping and the use of deadly force. The point isn't to prevent them from intentionally commiting crimes, the point is to ensure that they don't unintentionally commit crimes by being overzealous in their duties. These issues do not usually apply in computer forensics cases.