|
Computer Forensics Whitepaper - Computer Forensic Experts?

Introduction
Would you have an appendectomy performed by an unlicensed, unqualified doctor? Would you have an unlicensed, unqualified attorney defend your murder trial? Would you have your new house built by unlicensed, unqualified electricians and plumbers? Of course not!
Would you hire an unlicensed, unqualified computer forensics investigator to examine computer systems and provide expert witness testimony critical to your case? This occurs more often than you think...
There is a serious and growing problem within the Computer Forensic industry in Texas. From looking at this market, one may get the idea that professional responsibility is non-existent. Fortunately for the consumer of these services, this is not entirely true. Given the lack of governmental controls, it is imperative that one proceed with caution when hiring a Computer Forensic Expert.
Our research into the Texas Market produced forty firms that claimed to perform Computer Forensic services. Every Computer Forensic firm was either headquartered in Texas or maintained an office in Texas. What we found may astonish you. Information contained within this report is limited to the investigative field of Computer Forensics only. Data was obtained from multiple sources, including:
- The Texas Comptroller website
- The Texas DPS – Private Security Board website
- Chapter 1702, Private Security, of the Occupations Code
- The Texas Administrative Code
- Chapter 901, Accountants, of the Occupations Code
- Publicdata.com
- Computer Forensic Firm websites
- Josephson Institute of Ethics website
- Business Law Today, 7th Edition by Roger LeRoy Miller and Gaylord A. Jentz, Published by Thomson Higher Education, Copyright 2006
Statistics
Out of the 40 firms researched:
- (65%) 26 were not licensed by the Private Security Board
- (65%) 26 were not paying Sales Tax
- (50%) 7 of the licensed firms were not paying Sales Tax
- (.25%) 1 is operating under the Accountant Exception
- (.25%) 1 is operating under the Lawyer Exception
Out of the 26 firms not licensed:
- (27.5%) 11 advertise as performing work for a government agency
- (69%) 18 were not paying Sales Tax
- (12.5%) 5 have been in business more than 5 years (where a start date could be found)
- (8%) 2 most likely wouldn’t qualify for a license, based on information from publicdata.com

Texas Law
Problem 1: Texas codes are 20+ years behind current technology.
Problem 2: Severe lack of compliance by investigators with State licensing requirements.
Problem 3: Severe lack of compliance by investigators with State Tax Code.
Problem 4: Consumer is at high risk of receiving unqualified computer forensic services.
In 1969, the Texas Legislature passed a law requiring any individual, or business, providing investigative services to be licensed by the State. This law, the Private Security Act found in Chapter 1702 of the Occupation Code, is currently administered by the Texas Department of Public Safety through the Private Security Board, whose members are appointed by the Governor of the State of Texas.
Computer Forensics falls well within the State’s definition of an investigative service. As stated in the Private Security Act, a person acts as an investigator, if they engage in the business of obtaining or furnishing information related to the identity, habits, business, occupation, knowledge, efficiency, loyalty, movement, location, affiliations, associations, transactions, acts, reputation, or character of a person or engage in the business of securing evidence for use before a court, board, officer, or investigating committee.
The Private Security Act contains exceptions to the license requirements for private investigation companies, such as, 1) a government officer or employee performing official duties, 2) an attorney engaged in the practice of law, and 3) accounting firms licensed under Chapter 901 of the Occupations Code. Texas has no reciprocal agreements with any other States; however, the Private Security Board can issue temporary licenses for out-of-state investigators.
In addition to licensing requirements, the Texas Administrative Code governs the taxability of services provided by a Computer Forensic firm. Any service for which a license is required under the Private Security Act and includes any service provided as an investigations company, detective service, or private investigator is taxable on the total amount charged.

Lack of Enforcement
Problem 5: The need for consistent enforcement by the Private Security Board.
Problem 6: The need for enforcement by the Texas court system.
Problem 7: The need for Federal support of State licensing requirements.
There is a distinct difference between an Expert Witness providing testimony and a Private Investigator providing Computer Forensics according to the State of Texas; however, not everyone involved in the legal process agrees. Many believe the line between the two is blurred; this line is being crossed with great frequency. Over the years, many courts have allowed Expert Witness testimony to branch into the investigative arena without requiring a license.
According to thefreedictionary.com and answers.com, forensics is “the use of science and technology to investigate and establish facts in criminal or civil courts of law.” TechTarget, a security and technology publisher, defines Computer Forensics as “the application of computer investigation and analysis techniques to gather evidence suitable for presentation in a court of law”.
If one interprets Chapter 1702 of the Occupations Code literally, an Expert Witness can not secure evidence for use before a court, board, officer, or investigating committee, much less determine individual’s activities on a computer system.

Professional Responsibility
Problem 8: The extreme lack of ethics and professional responsibility by ignoring Texas Law.
According to the Josephson Institute of Ethics, ethics are standards for thought, word, and deed that constrain a person to do what is right and good (rather than simply what is easy, comfortable, or self-serving). Some examples of ethical values include honesty, integrity, loyalty, tolerance, acceptance, accountability, procedural fairness, impartiality, and adherence to the law.
Professional responsibility requires adherence to some ethical standard. Professionals, such as Computer Forensic Experts, are expected to conduct themselves in a manner consistent with their status. Professional responsibility would also embrace obedience to the laws of the State of Texas including licensing and taxation.

Computer Forensic Investigators
Problem 9: According to the laws of the State of Texas, NO COMPUTER EXPERIENCE REQUIRED.
Problem 10: Certifications tend to lull the consumer and courts into a false sense of security.
Computer Forensic Investigators are developed over time. Training, certifications, and licensing are insufficient without the critical element of experience. Each expert must be evaluated on a case-by-case basis to determine if their education, training, certifications, and experience are sufficient, regardless of licensing.
Here are a couple of actual experts:
Example 1: A Licensed Firm
The expert testified under oath that the defendants had deleted all the purported stolen data from the network storage device he had investigated. Later, it was discovered, after some insistence from the plaintiff, that the expert had made a mistake. All the data was intact on the device. This situation called into question every statement of fact made by the expert. Due directly to the expert’s mistake, the plaintiff had to settle the case prematurely.
Example 2: An Unlicensed Firm
While evaluating whitepapers written by this firm, we noticed numerous flaws in statements made about how various computer functions work, one of which states that “backup software uses date and time stamps” to determine what needs to be backed up. It’s actually a little simpler than that. There is a single bit of information called the archive bit which tells backup software that a file has been changed since its last backup. Some of the newer and more robust applications may allow you to use date and time, but it is not the default. This is only one of many erroneous statements regarding basic computer concepts, and little preparation would be needed to attack his credibility and call his skills into question.
Would you want one of these experts testifying in support of your case? What if they were testifying against your client? Is your Computer Forensic expert experienced enough to identify these errors and turn them to your advantage?

Computer Forensic Rates
Problem 11: Extraordinarily high rates - Bull Market or just plain bull.
The Federal Rules of Civil Procedure were recently amended with regards to the discovery of what is termed “electronically stored information.” One of the stated purposes behind these amendments was to help control the spiraling cost of electronic discovery.
As with any new technology market, hourly rates start off very high. Computer Forensics is a highly technical field and requires a vast amount of experience, but let’s get practical on rates. Our research shows Computer Forensic hourly rates starting at $250 and go as high as $500 per hour. Some companies will even charge their standard hourly rates for unattended computer processing time.
Would you like to be billed while your expert sleeps? No wonder the Federal government is concerned with the spiraling costs.

Conclusion
The Private Security Board is a Consumer Protection Agency whose mission is the protection of the public through fair and impartial regulation of the Private Investigators; however, the current law is woefully inadequate in this highly technical field of expertise.
Let’s not forget the statistics. Out of 40 Computer Forensic firms researched
a) 26 don’t know or don’t care to obtain a license,
b) 26 don’t know or don’t care to collect and pay Sales Tax, and
c) 7 of the 14 licensed firms don’t know or don’t care to collect and pay Sales Tax.
Out of the 26 firms not licensed
a) 11 claim to be performing work for a government agency,
b) 18 don’t know or don’t care to collect and pay Sales Tax,
c) 5 have been in business long enough to know the rules, and
d) 2 reportedly have a disqualifying criminal background.
Problem 1: Texas codes are 20+ years behind current technology.
Problem 2: Severe lack of compliance by investigators with State licensing requirements.
Problem 3: Severe lack of compliance by investigators with State Tax Code.
Problem 4: Consumer is at high risk of receiving unqualified computer forensic services.
Problem 5: The need for consistent enforcement by the Private Security Board.
Problem 6: The need for enforcement by the Texas court system.
Problem 7: The need for Federal support of State licensing requirements.
Problem 8: The extreme lack of ethics and professional responsibility by ignoring Texas Law.
Problem 9: According to the laws of the State of Texas, NO COMPUTER EXPERIENCE REQUIRED.
Problem 10: Certifications tend to lull the consumer and courts into a false sense of security.
Problem 11: Extraordinarily high rates - Bull Market or just plain bull.
While there are numerous problems within the Computer Forensic field of Private Investigation, Chapter 1702 has been sufficient for many years. As with any living document however, there comes a time when major rewrites become necessary.
There is a severe need for reform and improved enforcement of the Texas Private Security Act. A new chapter in the Occupation Code would be ideal, but adjustments to the current law would assist in the short term. Including the opinions of the courts in any reform process would help to ensure the statutes are followed and fully enforced. Until then, the consumer must bear the risk of their selection.
Consider this: opposing counsel will make every attempt to discredit your expert, and even if your expert is allowed to testify, a jury may question all facts that the expert may have discovered. Pick your expert carefully. If your expert fails to abide by professional standards, you may have a claim for malpractice, though the best course is to avoid this situation in the first place. If the expert’s actions constitute a statutory violation, such as Chapter 1702 of the Occupation Code, the professional may face liability and/or criminal penalties.
Some questions to ask yourself before making a final selection on a Computer Forensic Expert:
Question 1: Will the potential facts uncovered by my expert ever be heard?
Question 2: Will my expert be available when I need them or will they be in jail?
Question 3: Will my expert survive the professional responsibility challenge by opposing counsel?
Question 4: Does my expert have the right technology experience for my case?
Question 5: How much is this expert really going to cost?
If you have an unresolved issue with a Computer Forensic firm, licensed or not, here is the contact information for the Private Security Board. Please include the name and contact information of the firm and the license number, if available, in any correspondence.
Texas Department of Public Safety Private Security Board
P.O. Box 4087
Austin, Texas 78773-0001
For more information about PROTEGGA LLC or this whitepaper, feel free to contact us:
AskThePman@protegga.com
214.227.9752 [back] |