Electronic Data Records Law | How to Win E-Discovery

Employee Privacy on Social Network

Trespassing in Cyberspace

Computer Investigation Law

Investigators engaged in electronic discovery should be mindful of posted terms, conditions, EULAs, labels, notices, warnings, banners, contracts, agreements and no-trespassing signs.  They can have legal effect in the electronic world, and may be binding on an investigator who encounters them. 

Consider Pietrylo v. Hillstone Restaurant Group.  

While off-duty, restaurant employees maintained a password-protected MySpace forum, labeled as “talk about all the crap/drama/and gossip occurring in our workplace, without having to worry about outside eyes prying in.”  Pietrylo created and maintained the forum, explicitly designated it as “invitation only,” and distributed passwords to a limited number of employees.  One of these employees gave her password (whether voluntarily or otherwise is unclear) to restaurant management.  Management accessed the forum, and discovered . . .

Computer Forensics Experts: State Law Regulation

E-Evidence Collection and Processing for Traffic Cameras

The Texas Private Security Bureau issued an opinion saying it "generally" believes the operators of red-light cameras need not be licensed as private investigators.  The opinion may help us interpret law on the licensing of computer forensics experts.

The Bureau’s rationale is that the camera operators are performing mere "ministerial" actions at the direction of municipal government employees. (By qualifying its opinion with the word “generally,” the Bureau implies there could be exceptions.) In other words, the Bureau seems to believe the operators are not conducting the investigations that trigger a licensing requirement; rather, the municipalities are performing the investigations.

What Is This Government Agency?

The Private Security Bureau is the state government agency charged with implementing the PI licnesing law.  Its opinion is authoritative and carries weight.  Its formal opinion shows how the Bureau would interpret the law in an enforcement setting.  But the Bureau's opinion is not the last word on the meaning of the law.  While worthy of respect, the Bureau's opinion is not necessarily binding on a court.

Background: As reported before, a Texas judge held that the operator of a red-light traffic camera violated the law by failing to hold a private investigator's license. Now, for help in arguing the judge was wrong, the camera operator has appealed to the Private Security Bureau, and the Bureau has spoken.

Texas Legislation

This controversy is an unintended consequence of recent Texas legislation compelling computer forensics experts to get licensed as private investigators under state regulation. Last year the legislature amended the Texas Occupation Code so that Section 1702.104  now reads: "(a) A person acts as an investigations company [which must be licensed] if the person: (1) engages in the business of obtaining or furnishing, or accepts employment to obtain or furnish, information related to . . . the cause or responsibility for . . . loss, accident, damage, or injury to a person or to property. . . . (b) For purposes of Subsection (a)(1), obtaining or furnishing information includes information obtained or furnished through the review and analysis of, and the investigation into the content of, computer-based data not available to the public."

Analysis of Bureau's Opinion

Let's examine the logic of the Private Security Bureau in excluding traffic light camera operators. The Bureau reasons that Sec. 1702.321(a) excludes government employees from being licensed. Thus, thinks the Bureau, if at the direction of government employees (such as employees of the municipality of College Station) a business (i.e., a camera operator) performs “ministerial” acts in an investigation (i.e., obtaining of evidence), then that business need not be licensed.

So what is the implication of the Bureau’s logic?  Just as 1702.321(a) excludes government employees from licensure, Section 1702.324 excludes other people, such as “an attorney while engaged in the practice of law.” The reason for excluding attorneys is that they are licensed under the bar association.  It would seem that if direction from a government employee overcomes the need for a license, then direction from an attorney would overcome it too.

Therefore, it would seem that if an attorney hires a computer forensics professional to preform ministerial acts, then the professional would not need to get a PI license. But the Bureau does not explicitly say that.

Neither does the Bureau tell us what constitutes “ministerial” acts. Note that the Bureau opines that ministerial acts would exclude a person from the licensing requirement, even though the statute itself does not say that. Section 1702.104 broadly purports to require licensure for anyone engaged in the business of obtaining or furnishing investigative evidence.

Assessment of Bureau's Opinion

My own feeling is that the Bureau is headed in the right direction. A reasonable, practical interpretation of this too-broadly-worded statute would exclude from licensure those people (including businesses) engaged in collection of evidence under the close direction and supervision of another qualified person such as a government employee or a licensed attorney.

What I don't know is this:  Are red-light camera companies actually performing under the close direction and supervision of government employees?

–Benjamin Wright

Mr. Wright teaches the law of cyber investigations at the SANS Institute.

Update 2013:  Private investigator licensure can be unexpected issue in cyberspace.