Mention to anyone in the Digital Forensics field that you are a DF examiner or investigator and you may quickly find yourself in a licensing & regulation discussion.

By interpretation, the state of South Carolina (via SC’s State Law Enforcement Division – SLED) has decreed that one must hold a Private Investigator’s license in order to fulfill the role of computer forensic examiner.

This often cited law actually comes from the first answer of in a SLED FAQ and a nearly six year old SC Attorney General opinion. No existing state statute exists mandating that computer forensic examiners must be licensed Private Investigators.

In fact, the current relevant South Carolina Code of Laws states:

South Carolina Code of LawsSECTION 40-18-20. Definitions

As used in this chapter, unless the context otherwise requires, the term:(A) “Private investigation business” means engaging in business or accepting employment to obtain or furnish information with reference to the:(1) identity, habits, conduct, business, occupation, honesty, integrity, credibility, knowledge, trustworthiness, efficiency, loyalty, activity, movement, whereabouts, affiliations, associations, transactions, acts, reputation, or character of a person;(2) location, disposition, or recovery of lost or stolen property;(3) cause or responsibility for fires, libels, losses, accidents, damage, or injury to persons or property; or(4) securing of evidence to be used in a criminal or civil proceeding, or before a board, an administrative agency, an officer, or investigating committee.

 

And the then South Carolina Attorney General, Henry McMaster wrote on April 23, 2007, in response to the then SLED Chief of Staff, Chief Mark Keel:

Consistent with such, in the opinion of this [South Carolina Attorney General] office, the better reading of Sections 40-18-20, 40-18-30 and 40-18-70 support the conclusion that such provisions require that an individual or company selling their services in South Carolina as “computer forensics” experts secure licenses as private investigators. Such determination would be applicable to individuals who accept fees to examine and copy computer hard-drives to extract information to be reported to clients and to be presented in courts as evidence and/or testimony in civil and criminal actions. The duties performed by such individuals or companies would appear to meet the definition of “private investigation business.”

In recent years, there has been an effort underway in SC to formalize this discussion into perhaps more clearly worded language.  The most recent attempts occurred in the State Legislative Sessions of 2010-2011 and 2011-2012.  In 2012, S.580 made it to the Governor’s office where it was vetoed.

As I enter my seventh year of paying SLED an annual fee of $350 in order to perform the duties of a computer forensic examiner in the South Carolina I ask you — What do you think the South Carolina legislature should do in the upcoming term regarding Digital Forensic legislation?