PROTEGGA LLC - Computer Forensics WhitePaper - Texas Licensing Requirements (Clarified)

Computer Forensics Whitepaper - Texas Licensing Requirements (Clarified)

Introduction

In the whitepaper "Computer Forensic Experts?" posted last year, we pointed out some of the issues within the Computer Forensic industry in Texas. With much support from the Private Investigation industry, Texas has addressed some of the issues documented in the previous whitepaper. This paper serves as an update to the initial report. Again, this paper focuses only on the Computer Forensic market in Texas and not the Private Investigation industry as a whole.

Issues Outlined in "Computer Forensic Experts?"

Problem 1: Texas codes are 20+ years behind current technology.
Problem 2: Severe lack of compliance by investigators with State licensing requirements.
Problem 3: Severe lack of compliance by investigators with State Tax Code.
Problem 4: Consumer is at high risk of receiving unqualified computer forensic services.
Problem 5: The need for consistent enforcement by the Private Security Board.
Problem 6: The need for enforcement by the Texas court system.
Problem 7: The need for Federal support of State licensing requirements.
Problem 8: The extreme lack of ethics and professional responsibility by ignoring Texas Law.
Problem 9: According to the laws of the State of Texas, NO COMPUTER EXPERIENCE REQUIRED.
Problem 10: Certifications tend to lull the consumer and courts into a false sense of security.
Problem 11: Extraordinarily high rates - Bull Market or just plain bull.

Our research into the Texas Market produced forty firms that claimed to perform Computer Forensic services with thirty-seven of those currently in operation. Every Computer Forensic firm was either headquartered in Texas or maintained an office in Texas. Information contained within this report is limited to the investigative field of Computer Forensics only. Data was obtained from multiple sources, including:

The Texas Comptroller website
The Texas DPS – Private Security Board website
Chapter 1702, Private Security, of the Occupations Code
The Texas Administrative Code
Chapter 901, Accountants, of the Occupations Code
Publicdata.com
Computer Forensic Firm websites
Josephson Institute of Ethics website
House Bill Number 2833 - Legislative Session: 80(R)

Updated Statistics
Out of the 37 Computer Forensic firms:

(67%) 25 of 37 do not hold an active license by the Private Security Board
(62%) 23 of 37 were not paying Sales Tax
(33%) 4 of the 12 licensed firms were not paying Sales Tax

Texas Law

In 1969, the Texas Legislature passed a law requiring any individual, or business, providing investigative services to be licensed by the State. This law, the Private Security Act found in Chapter 1702 of the Occupation Code, is currently administered by the Texas Department of Public Safety through the Private Security Board, whose members are appointed by the Governor of the State of Texas.

Computer Forensics falls well within the State’s definition of an investigative service. As stated in the Private Security Act, a person acts as an investigator, if they engage in the business of obtaining or furnishing information related to the identity, habits, business, occupation, knowledge, efficiency, loyalty, movement, location, affiliations, associations, transactions, acts, reputation, or character of a person or engage in the business of securing evidence for use before a court, board, officer, or investigating committee.

CHANGE EFFECTIVE September 1, 2007 - While Texas already required Computer Forensic Investigators to obtain a license, Chapter 1702 of the Occupations has been clarified. The following text has been added, "obtaining or furnishing information includes information obtained or furnished through the review and analysis of, and the investigation into the content of, computer-based data not available to the public."

The Private Security Act contains exceptions to the license requirements for private investigation companies, such as, 1) a government officer or employee performing official duties, 2) an attorney engaged in the practice of law, and 3) accounting firms licensed under Chapter 901 of the Occupations Code. Texas has no reciprocal agreements with any other States; however, the Private Security Board can issue temporary licenses for out-of-state investigators.

CHANGE EFFECTIVE September 1, 2007 - A few organizations operating within Texas were operating under the exemptions noted above. Again, this law hasn't changed, but has been clarified. "while performing services regulated under Chapter 901" has been added to the accounting exemption. Another clarification was added, "The exemptions provided by Subsection (b) apply only to a person described in that subsection while the person is performing services directly related to and dependent on the provision of the exempted service that does not otherwise require licensing under this chapter. The exemptions do not apply to activities or services that are independent of the service or profession that is the basis for the exemption." This apparently wasn't clear to some.

In addition to licensing requirements, the Texas Administrative Code governs the taxability of services provided by a Computer Forensic firm. Any service for which a license is required under the Private Security Act and includes any service provided as an investigations company, detective service, or private investigator is taxable on the total amount charged.

No changes were made to the taxability of these services.

Lack of Enforcement

Problem 5: The need for consistent enforcement by the Private Security Board.
Problem 6: The need for enforcement by the Texas court system.
Problem 7: The need for Federal support of State licensing requirements.

There is a distinct difference between an Expert Witness providing testimony and a Private Investigator providing Computer Forensics according to the State of Texas; however, not everyone involved in the legal process agrees. Many believe the line between the two is blurred; this line is being crossed with great frequency. Over the years, many courts have allowed Expert Witness testimony to branch into the investigative arena without requiring a license.

According to thefreedictionary.com and answers.com, forensics is “the use of science and technology to investigate and establish facts in criminal or civil courts of law.” TechTarget, a security and technology publisher, defines Computer Forensics as “the application of computer investigation and analysis techniques to gather evidence suitable for presentation in a court of law”.

If one interprets Chapter 1702 of the Occupations Code literally, an Expert Witness can not secure evidence for use before a court, board, officer, or investigating committee, much less determine individual’s activities on a computer system.

CHANGE EFFECTIVE September 1, 2007 - Steps were also taken to strengthen the penalties for violations of this law. The clarifications should help the Justice system in understanding the intent of the law. The Civil Penalties were changed to read, "A person who is not licensed under this chapter, who does not have a license application pending, and who violates this chapter may be assessed a civil penalty to be paid to the state not to exceed $10,000 for each violation." These penalties were also extended to a person hiring an unlicensed investigator by adding, "A person who contracts with or employs a person who is required to hold a license, certificate of registration, or security officer commission under this chapter knowing that the person does not hold the required license, certificate, or commission or who otherwise, at the time of contract or employment, is in violation of this chapter may be assessed a civil penalty to be paid to the state in an amount not to exceed $10,000 for each violation." Each day the violation occurs is consider another violation with additional fines until remedied.

Professional Responsibility

Problem 8: The extreme lack of ethics and professional responsibility by ignoring Texas Law.

According to the Josephson Institute of Ethics, ethics are standards for thought, word, and deed that constrain a person to do what is right and good (rather than simply what is easy, comfortable, or self-serving). Some examples of ethical values include honesty, integrity, loyalty, tolerance, acceptance, accountability, procedural fairness, impartiality, and adherence to the law.

Professional responsibility requires adherence to some ethical standard. Professionals, such as Computer Forensic Experts, are expected to conduct themselves in a manner consistent with their status. Professional responsibility would also embrace obedience to the laws of the State of Texas including licensing and taxation.

CHANGE EFFECTIVE September 1, 2007 - While there were no changes specifically addressing ethics and professional responsibility, hopefully the changes outlined above will remove some of the organizations that have this problem. Additionally, the State Comptroller can now go after these firms to ensure compliance with State Tax Laws.

Computer Forensic Investigators

No changes were made in this area.

Problem 9: According to the laws of the State of Texas, NO COMPUTER EXPERIENCE REQUIRED.
Problem 10: Certifications tend to lull the consumer and courts into a false sense of security.

Computer Forensic Investigators are developed over time. Training, certifications, and licensing are insufficient without the critical element of experience. Each expert must be evaluated on a case-by-case basis to determine if their education, training, certifications, and experience are sufficient, regardless of licensing.

Here are a couple of actual experts:
Example 1: A Licensed Firm
The expert testified under oath that the defendants had deleted all the purported stolen data from the network storage device he had investigated. Later, it was discovered, after some insistence from the plaintiff, that the expert had made a mistake. All the data was intact on the device. This situation called into question every statement of fact made by the expert. Due directly to the expert’s mistake, the plaintiff had to settle the case prematurely.

Example 2: An Unlicensed Firm
While evaluating whitepapers written by this firm, we noticed numerous flaws in statements made about how various computer functions work, one of which states that “backup software uses date and time stamps” to determine what needs to be backed up. It’s actually a little simpler than that. There is a single bit of information called the archive bit which tells backup software that a file has been changed since its last backup. Some of the newer and more robust applications may allow you to use date and time, but it is not the default. This is only one of many erroneous statements regarding basic computer concepts, and little preparation would be needed to attack his credibility and call his skills into question.

Would you want one of these experts testifying in support of your case? What if they were testifying against your client? Is your Computer Forensic expert experienced enough to identify these errors and turn them to your advantage?

Computer Forensic Rates

No changes were made in this area.

Problem 11: Extraordinarily high rates - Bull Market or just plain bull.

The Federal Rules of Civil Procedure were recently amended with regards to the discovery of what is termed “electronically stored information.” One of the stated purposes behind these amendments was to help control the spiraling cost of electronic discovery.

As with any new technology market, hourly rates start off very high. Computer Forensics is a highly technical field and requires a vast amount of experience, but let’s get practical on rates. Our research shows Computer Forensic hourly rates starting at $250 and go as high as $500 per hour. Some companies will even charge their standard hourly rates for unattended computer processing time.

Would you like to be billed while your expert sleeps? No wonder the Federal government is concerned with the spiraling costs.

Conclusion

The Private Security Board is a Consumer Protection Agency whose mission is the protection of the public through fair and impartial regulation of the Private Investigators and with the recent changes to Chapter 1702 of the Occupations Code have made great strides in meeting their charter. Their work unfortunately will never be complete.

Let’s not forget the current statistics. Out of the 37 Computer Forensic firms 25 don’t know or don’t care to obtain a license, 23 don’t know or don’t care to collect and pay Sales Tax, and 4 of the 12 licensed firms don’t know or don’t care to collect and pay Sales Tax. Of course, we believe there are more changes on the horizon and PROTEGGA will assist the State of Texas anyway we can.

Problem 1: Texas codes are 20+ years behind current technology.
The changes made this year are a good start, but more work needs to be done in order to ensure knowledgeable and ethical Computer Forensic Investigators are available to the public. Enforcement of the law is key to any advancement.

Problem 2: Severe lack of compliance by investigators with State licensing requirements.
Problem 3: Severe lack of compliance by investigators with State Tax Code.
Hopefully, the new changes will fix these 2 problems, but it will take some time. We will check again this time next year and see how much of the problem still exists.

Problem 4: Consumer is at high risk of receiving unqualified computer forensic services.
Be careful. Investigative experience is covered by the licensing requirements, but not computer forensics. Make sure your expert is qualified.

Problem 5: The need for consistent enforcement by the Private Security Board.
Problem 6: The need for enforcement by the Texas court system.
The changes are very good, but enforcement is key. Only time will tell.

Problem 7: The need for Federal support of State licensing requirements.
Let's all hold our breath.

Problem 8: The extreme lack of ethics and professional responsibility by ignoring Texas Law.
The news laws should help weed out the undesireables, but caution should be taken in any selection process. Ethical behavior is not a very popular practice these days.

Problem 9: According to the laws of the State of Texas, NO COMPUTER EXPERIENCE REQUIRED.
Problem 10: Certifications tend to lull the consumer and courts into a false sense of security.
Computer forensic experience is still not required and computer training is still not listed as acceptable continuing education credits. There is definitely room for improvement in this area and we will push for more changes.

Problem 11: Extraordinarily high rates - Bull Market or just plain bull.
There really isn't anything here the State of Texas can fix. It will take time, like any new market, for the pricing structure to settle down.

If you have an unresolved issue with a Computer Forensic firm, licensed or not, here is the contact information for the Private Security Board. Please include the name and contact information of the firm and the license number, if available, in any correspondence.

Texas Department of Public Safety Private Security Board
P.O. Box 4087
Austin, Texas 78773-0001

For more information about PROTEGGA LLC or this whitepaper, feel free to contact us:
AskThePman@protegga.com
214.227.9752
[back]