Ride the Lightning

MICHIGAN SAYS YOU NEED A SECURITY CERTIFICATION TO BE A PI

February 4, 2009

This recent computer forensics listserve posting says it all. Has Michigan lost its collective mind? This sort of protectionism is just plain nuts. If you are in Michigan, write to Adam. Take the recent ABA resolution (reprinted below) that says that computer forensics technologists should not be required to have PI licenses and get the legislature to repeal the law. As a standiing offer, John and I will go anywhere to testify on this matter before state legislatures. We, like the ABA, support computer forensics certifications that are specific to our profession.

"Michigan update:

I applied for my MI PI license on June 3, 2008. I have been officially informed today, January 22nd, 2009, that the ISFCE-CCE DOES NOT constitute a "computer forensics certificated study acceptable to the board" standard. If you are seeking a PI License in Michigan, other requirements must be satisfied. I will be appealing this decision and after all administrative options have been exhausted, litigation is likely. I find it hard to believe that the USA District Court can find me an acceptable expert in computer forensics yet the State finds it acceptable to deny me my livelihood. A committee was formed to determine the "computer forensics certificated study acceptable to the board". Their decision was that a network security requirement along with a cert like CCE is required. I do not understand how a cert like the CISSP would be mandatory given the language of the statute. Is the CISSP a computer forensics certificated study?

Computer forensics is now regulated in Michigan, but it is much different than the regulation of a doctor or lawyer. One must be a PI (or an employee of a private detective agency) to perform computer forensics. There currently is no standard in demonstrating proficiency in computer forensics. For example, one holding a criminal justice bachelor's degree may receive a PI license and practice computer forensics, but those with computer science and practical computer forensics experience are excluded. Being recognized as an expert by the Federal Court is not an acceptable credential. It is sad that individuals like Mark McKinnon and myself cannot practice computer forensics with our own license. I will be working diligently to allow computer forensics specialists to practice in the State of Michigan. If any of you wish to join the battle, please contact me off list."

Adam can be reached at

*******************************

RESOLVED, That the American Bar Association urges State, local and territorial legislatures, State regulatory agencies, and other relevant government agencies or entities, to refrain from requiring private investigator licenses for persons engaged in:

• computer or digital forensic services or in the acquisition, review, or analysis of digital or computer-based information, whether for purposes of obtaining or furnishing information for evidentiary or other purposes, or for providing expert testimony before a court; or

• network or system vulnerability testing, including network scans and risk assessment and analysis of computers connected to a network.

FURTHER RESOLVED, That the American Bar Association supports efforts to establish professional certification or competency requirements for such activities based upon the current state of technology and science.

Hat tip to Mike Maschke.

E-mail:      Phone: 703-359-0700

http://twitter.com/sharonnelsonesq