Presumably Decius is concerned primarily with the definition apparently now covering computer security analysis as follows (excisions mine, for clarity) : 'Private detective business' means ... the business of obtaining or furnishing, or accepting employment to obtain or to furnish, information, including ... digital or electronic information, with reference to:
...
(C) The location, disposition, or recovery of lost or stolen property;
(D) The cause or responsibility for ... losses, ... damage, ...
I have to admit it seems rather absurd to require that the nerds going through your server logs be licenced PI's. That being said, given the potential for such data to be used as evidence, it wouldn't hurt for them to be trained in the relevant laws thereof. I'm not certain I see categorically how removing a virus would fall into these provisions however, and I'd like to hear what I've missed.
Perhaps insofar as it would require you as an IT professional to "furnish information" that the "losses" resulting from downed computers was due to such-and-such virus in the course of your removal of it? Anyway, I think there's two different aspects to consider here. The first is your normal IT functions, such as virus and spyware removal, the configuring and monitoring of firewalls, etc., and the second is more advanced computer security such as responding to system compromises, "forensic" data analysis, systems fraud monitoring, etc. The former, I'd think, should be pretty much completely exempt from any sort of regulation. The latter, on the other hand, as I've said, has implications for evidence and the potential recovery of losses or the proscecution of a criminal investigation. Given that, I actually don't oppose the notion that such workers should be verifiably conversant in the legalistic aspects of their work. As a matter of fact, I'm kind of surprised that those kinds of activities aren't already considered as being the exclusive jurisdiction of "the Law". Allowing company employees to process information that exposes the perpetrator of an alleged criminal act seems rather like allowing the fox (or, perhaps, merely the fox's close friend) to guard the henhouse. Don't confuse my statements with endorsing this law, mind you. I absolutely don't think the law as it stands addresses what I'm talking about. Neither kind of work is quite the same as existing licenced PI or PS activities where you have trained personnel, frequently armed, handling physical security or so forth. -k] hb504_LC_29_2714_a_2.html |
