The Lazy Genius

Security News & Brain Dumps from Xavier Ashe, a Bit9 Client Partner

We're too late…

Posted by Xavier Ashe on April 30, 2006

A new law in Georgia on private investigators now extends to computer forensics and computer incident response, meaning that forensics experts who testify in court without a PI license may be committing a felony.


In the U.S. television show “Medium,”
Patricia Arquette's character uses her “special psychic skills” to help
solve crimes. If a new law passed by the Georgia legislature but not
yet signed by the Governor goes into effect, not only could Miss
Arquette's character face legal troubles, but thousands of computer
security consultants would face the very real threat of jail time –
simply for plying their trade.

According to the legislature, a Private Investigator
is any person who is in the business of obtaining or furnishing, or
accepting employment to obtain or to furnish, information with
reference to:

(A) Crimes or wrongs done or threatened against the United States of America or any state or territory thereof;

(B) The background, identity, habits, conduct, business, employment,
occupation, assets, honesty, integrity, credibility, knowledge,
trustworthiness, efficiency, loyalty, activity, movement, whereabouts,
affiliations, associations, transactions, acts, reputation, or
character of any person;

(C) The location, disposition, or recovery of lost or stolen property;

(D) The cause or responsibility for fires, libels, losses, accidents, damage, or injury to persons or property;

(E) The securing of evidence in the course of the private detective
business to be used before any court, board, officer, or investigating
committee; or

(F) The protection of individuals from serious bodily harm or death.

In addition to the aforementioned services, “private detective
business”” shall also mean providing, or accepting employment to
provide, protection of persons from death or serious bodily harm.”

Typical “Magnum PI” kind of stuff. The problem is that the statute is
written so broadly as to include almost all types of computer forensics
and computer incident response – at least when done by outside
consultants. After all, when do you need computer forensics, or
incident response? Typically, you call in a computer forensics expert
when you suspect something “bad” has happened. Thus, you retain the
expert to furnish information with respect to possible crimes or wrongs
(the phrase against the United States or any State or territory doesn't
mean that the State is the victim of the crime, just that it violates
the state law.)

You also retain forensic experts to collect evidence about damages and
loss to you – from computer viruses, worms, attacks, and so on. You
want to know what happened, how it happened, why it happened, and how
to prevent it from happening again. You want to know the, “cause and
responsibility for … losses and damage to … property.” Namely, this
applies to your computer network and the information contained in it.
You also want the information collected in a way so that it can be used
in court or by other investigators later on, even if you do not intend
to pursue a civil or criminal case. If information is stolen, you want
to know the “location, disposition and [ensure the] recovery of lost or
stolen property” namely the intellectual property stored on the
computer. For all of these things, you would typically hire not a
gumshoe, but a forensic expert. Unfortunately, under this new law that
forensic expert would be committing a felony.

Complete coverage on Security Focus.

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
%d bloggers like this: