Diary of a Network Geek

No, not really.

So, there’s obviously been quite a furor about this new law here in Texas that apparently requires anyone doing any kind of computer forensic work to get a Private Investigator’s License. Now, one of my favorite computer security bloggers, Security Monkey (aka The Chief) of A Day in the Life of an Information Security Investigator, has a blog entry about this. His sources in Texas have a different, more relaxed, take on this law. They seem to think that it’s only going to effect professionals doing investigative work for a third party. I think they’re wrong.
As at least one other commenter on A Day in the Life of a Computer Security Investigator pointed out, no matter what the lawyers think and say, only a judge sitting on a case can really interpret the law. And, only after that precedent is set can anyone say what the law covers and doesn’t.
Based on the Slashdot story about someone getting charged with a felony for using a fake name to sign up to MySpace, it seems like this is going to be an important step in the process. I mean, until that all important precedent is set, there’s no telling how people will try to use this new law.

As I wrote here the other day about this far-reaching law, I think it’s just another example of the sad state of our legal system. Laws like this have effects that are much, much further reaching than the bill’s author intended, and it’s ripe for abuse by our overly litigious society.

Advice from your Uncle Jim:
"Whether you think you can or think you can't, you're right."
   --Henry Ford

The Houston Chronicle has an update on the law I mentioned the on Tuesday.

The Austin office of the Houston Chronicle did some more digging about the new law that would seem to require PC Techs in Texas to also become Private Investigators. According to the bill’s author, state Rep. Joe Driver, R-Garland, we’re all misinterpreting his new law. He claims that the law means “…anyone who retrieves data from a computer, analyzes it and makes a report to a third party must obtain a private investigator’s license.” To me, it’s almost the same thing.

As I read it, the law would require anyone performing computer security duties in *any* setting in Texas to get a PI License. That means that a corporate computer security officer, who’s job may include computer forensics, would be required to also be a PI.
Frankly, I’m torn between thinking that maybe this is a good thing and maybe it’s excessive. On the one hand, for someone who does independent security work, that background check and finger printing might be a good idea! On the other hand, it might make it impossible for someone in a small company to *legally* do their job.

I’ll give an example…
A small company may have a one or two person IT department who cover everything, like, for instance, me. If there’s a break-in to one of their systems, they would then have to be a licensed PI to investigate that, or they’d have to spend a similar amount of money on a consultant who was. In this case, I’d bet the law just would get ignored.

But, for the independent operator, who might not have any other controls or credentials which a consumer or consulting client can use as a measure of relative security, it might actually be a good thing. Again, I doubt that criminal background checks are being done on all independent computer security consultants right now and maybe they should be.

In any case, like many laws of this nature, they seem like a good idea on paper, but often have much further reach than their author intended.

So, now I need a Private Investigator’s license to work on PCs?

Yeah, according to articles at ExtremeTech and CW33, a recently passed law in Texas requires that ALL shops which include PC repair technicians have a PI license. Just so you know, a PI License isn’t for an individual, but, rather a business and all the employees would work under that umbrella license. Still, it would mean that at least one person go through the process of licensing, which has the following requirements:

• three years of investigative experience or a bachelors degree in criminal justice for investigations company license
• two consecutive years of legally acceptable experience in the guard company business
• successful completion of a two-hundred-question examination testing ability of the manager applicant to operate the guard company under the provisions of the statute regulating them
• criminal background check
• submitting fingerprints to have on file with the FBI
• ~$500 in registration fees, subscription fees, application fees, and fingerprint fees, payable yearly

(All that is from an article at Citronix Computer Techs. )

Now, it’s important to understand, too, that this is a brand new law, sponsored by a Private Investigation professional organization who are afraid of their profession becoming obsolete. Thankfully, there are also techs who have professional organizations, one of which is challenging the law, at least, according to KVUE.com.

Funny, I’ve always thought about getting a PI license and now I may be forced to do so! On the other hand, the $4000+ fines and possible jail-time are a great excuse for why I can’t help people at work with their private PCs!