 So I'm Scott Moulton. I do computer forensics, has my day job. I also run a data recovery company. So a lot of you probably know me from some of my other speeches which are all animated. I do all those nice, rich, expensive animations for hard drives in solid state. And while this speech isn't actually animated, I do have another one later this afternoon at 6 o'clock which is all about solid state hard drives that is animated. But one of the things that some of you might not know if you submit a speech to Black Hat, if they reject you, they send you the comments that other people who are paying people actually make statements about your presentation. So I submitted this one to Black Hat. And the comments I got back when they rejected me, there was one guy who says, you know what? I would really like to see an animated version of a computer forensics guy taking a PI exam. So he thought it was pretty funny but ha ha ha. So I said something to my son about that and he turned around and made us this. So this is going to be the extent of animation in this presentation. So there you go. And that was, that's done by Brandon right here in the, there you go. Thank you Brandon. All right, so let's start off. So outside of that, this is not animated. So if you wanna see the animated stuff and all the bills, zillion dollars of that, that's this afternoon. And then the other thing I wanna make sure is I am not your lawyer. I'm not a lawyer. I'm not going to be your lawyer. You can call me for defense work or something. I'll help you out. But so you gotta do all your own work to try to figure out what's legal in your states. And I'll tell you what, there's a lot of gray area. There's a lot of stories saying, oh it's good this day but it's not good this day. So you're just gonna have to trust me on that and make sure you talk to your lawyer. And I'm pretty sure there's gonna be a lot of angry people about this stuff. And keep in mind I did not, I am not the person who's trying to do this legislation. So don't throw stuff at me. I just had to be the first person that was actually tried to be removed because of this legislation two years ago. So just keep that in mind. Don't get all angry and throw stuff at me. The real story here is if you wanna do something about it you should really try to have tech people becoming politicians. Because in the near and short future that's all we're gonna have. If no tech people get involved there's not gonna be any solutions to any of these problems. So this is for your entertainment. So why this speech is important to you. The first thing is that in a lot of states and a lot of different places these laws are going into effect with no grandfathering. They're taking place immediately and I wrote this speech months and months ago before other issues like Michigan and stuff have come up. But I've been anticipating that this was gonna be a problem for about two years and I've been posting on boards in every place I can post for the last two years. So a lot of you can see that if you just Google my name or do something. But this is very important that they're coming in with no grandfathering which means in about 30 days they pass these laws. Next thing you know you're out of business. So if anybody, how many people in here are doing computer forensics? Wow that's a pretty good amount of people. How many in here are doing it for a private third party company? That's about a half of that. So that's the big issue. If you're doing it for an internal company something like AT&T or someplace like that technically you're not violating the law but if you're going outside of that you're violating the law. So if this passes in 30 days and you didn't even know about it you're out of a job. One more time. How many of you are already PIs? Oh that's a really low number. What two, three people in the whole room. So besides me. So and then the other thing is is that in a lot of cases the PI board is just making one change. They're trying to change what is currently a misdemeanor to a felony and then going after people saying that we didn't make a big change in the law. All we did was make it now a felony for the things that already were a PI and then trying to apply it to computer stuff. So you're gonna find that out here in a few minutes. Most of us people just do not believe applies to them at all. I've had a number of discussions with people that just say well I don't fit into that description but when you start looking at the content and what it really means if you're holding yourself out as a third party you're doing anything for any legal purpose then basically that ends up being the things that fall under that category. So there's a couple of things we'll go through them. But even people who do like handwriting analysis and stuff they believe that this does not apply to them. That there's one certification for handwriting analysis and if you're gonna testify in court you've gotta have this one certification and that's all that applies to them. But a certification is not a professional license. There is a division there. Basically professional licenses are done by states and the states decide who's in charge there's a board put in place and then there's a charge and there's a number of things you have to go through. A certification does not fit into that category at all period. Sometimes a certification is used to get the license but it is not the license. So I just wanna make sure you guys are clear on that as we're going through this cause I'm gonna anger some people about what the point of a certification is if you have to be a PI. So these people just don't believe it applies to them. So this is an example of what just happened. How many people here are from Michigan? Okay so there's a few. So how many people were aware that it's now felony to do the crime of computer forensics in Michigan? Yeah so there's only a few people who weren't. So right now as of May 28th going into effect immediately passing in about 30 days they basically changed the law to state and they actually included the definition of computer forensics but it took effect immediately the same day that they passed it which was May 28th, 2008. And now it is a felony. So the penalty is that you get a possibility and if it's a felony you're gonna get at least one year in jail in most cases. And so up to four years and then a $5,000 fine. And if you've already been convicted of a felony you can't become a PI. So you're kind of like after you're out you can't even go do the job you were already doing. So I think that's a pretty big deal. And one of the opinions about these laws that are starting to take place people think that regulation is needed. I hear that all the time. It's like oh this is a good thing. That regulation is needed. And because that way the geek squad isn't stealing your personal private information because now they've got to be a PI. I don't know that's gonna solve the problem because generally those aren't the people you're paying them. So they're not generally stealing your information. And then a lot of people really the PIs in most cases have kind of a bad rep. When you say PI you think well they're doing surveillance or something. So most people would accept the worst computer guy they know over a PI doing their work. And so that's an opinion I hear all the time that's not my opinion directly but it's in there. And then a lot of people say that this is a field of science and if it's a field of science then why is it trying to fit underneath this PI wing where there is no science? There's nothing to the test. There's nothing from that standpoint that is scientific. So and then as I stated earlier people who do like question documents and handwriting experts as they leave whatever legality the types of fields that they're working in and they go into a third party and try to sell their skills and testify maybe for the defense or something that's now becoming an issue. So these people just don't think that it applies to them and it's kind of if you're in a situation where the law applies to some people but then not other people and somebody can choose whether or not they're gonna prosecute you or not then typically you're looking at void for vagueness or something like that and some laws. Again, I'm not a lawyer so. And then a lot of other people think that all PIs do is surveillance. So if they're doing surveillance how helpful are they gonna be to you doing computer forensics or doing anything else? So this comes to my point which is all of these certifications. How many people have at least one of these somewhere? That's pretty much the whole room, most of room. Somebody's got at least one of these certifications and regardless of which of these certifications that you have it is all trumped by this. If you go and you get your PI license that is what is going to be what is enabling you on the stand. Now I understand you can still be qualified as an expert and you can still testify and not have to have the license but after talking to several lawyers the issue becomes you've just testified that you committed a felony. So now they just use your testimony in the prosecution of you. So they may allow you to testify but basically this is gonna be the first step now of are you a PI, if you're not a PI then get him out of the court because he's not qualified because he's not licensed by the state. So that becomes a major issue. So basically this is a summary type email that I got from somebody because the whole point comes down to that this guy finds it shocking and never minded that states think that computer forensics experts have to have a license in order to testify but yet private investigators can have no clue about what's on the computer but yet they are the only ones who can testify. So what he's saying here and I agree with it wholeheartedly this is what the whole thing is about is that they are legally enabled to testify in a case even if they've never touched a computer. They have rights that you don't have even though you may have been doing computers for 25 years. So that's starting to become a major issue and with some of the time frames it takes to become a PI it's not a short issue either. So this is how I was introduced to this problem. In April of 2006 I was on the stand just fine in a criminal trial and a prosecutor comes up and basically starts questioning me about whether or not I had a license and a PI and I basically said no I don't need one it's computer forensics I'm not a PI and so he went down that whole list but what had just happened unbeknownst to me is that a few days earlier four days earlier in March that the state of Georgia had basically passed a law making it a felony and these the type of content for the questions he was asking me basically made it sound like you are now committing a felony but it didn't go into play yet it didn't go into effect it didn't go in immediately like it did in Michigan where I actually have friends who had to shut down their shop the same day. I have friends that already were doing computer forensics already working on cases and had to quit and after two months still haven't clarified whether or not they're gonna be a private investigator or whether or not they can continue on the case they were already contracted to do but in Georgia they basically put it off until July 1st. So on July 1st it was gonna become a felony and that was the big deal is that at that spot in time the prosecutor was trying to say to the judge look we already passed this this was already going to be a law it goes into effect on July so he's not qualified he doesn't have a license let's get him out of here so that he can't testify in our case. Luckily the judge allowed me to testify and it wasn't quite a crime at this point so I was kinda okay at that particular spot probably more because the lawyer tried to explain what the law was to the judge and the judge goes look here young man I'm a judge I've been on this stand for 20 years yeah I don't need you to explain the law to me so however it works it works it worked in my favor so so basically I started doing some research at this point in time I'm trying to find out well I didn't even know anything about this law that he's now talking about so as soon as I got off the stand even though I was accepted I better figure out what the heck's going on here so I started doing some research and went through the process looked up forensics so now I tell you you know obviously there's no Magnum CSI or Quincy PI or anything like that but they did get Rockford Files right so at least with computer stuff we've got some terminology but computer forensics is a branch of forensics pertaining to legal evidence and it's using computers and digital storage and to me that doesn't sound like anything that PIs were doing they currently at least if you thought oh well I need to look at this computer the first thing you thought was let's call PI I don't think so that wasn't the way it was going so then I started looking at the content for what was submitted as the bill this is the actual bill is HB 1259 and it was past it was submitted on February 6th and passed on March 30th it was never posted anywhere else on any of the PI boards or anything like that or only the websites only on your legislation page so you have to pay attention to your legislation page and now obviously you're gonna have to start paying attention to anything that's submitted by any of the Senators or Republicans for PI license or anything that affects the current PI license and they don't have one that they just number them so you're just not gonna know right off the bat oh I need to always look for 1259 or something like that you have to start reading what the laws are that are submitted and what summary is and if you see one that says private investigators you've got to look that up and make sure that it doesn't affect you and they're not making changes that are a big deal and sometimes they don't use the word computer forensics or digital at all in the law they didn't in Georgia so you have to read it and see if it applies to you by using a number of different things or talk to your lawyer but one thing I wanna point out here is that on the morning of the 30th they basically tried to pass this it didn't pass they had a couple of nays and then all of a sudden bam in the afternoon they got those people to agree I don't know what they did but somebody talked to somebody and got somebody to agree we need to pass this law so somebody got some payoff or something I don't know so after researching this I was already working with a couple of criminal attorneys and stuff like that so basically I put this stuff in front of them and I said all right if you were prosecuting somebody for this what do you think about it and so of course he'd like take my money so it's okay but outside of that he said I wouldn't wanna have to try to prevent you from going to jail for this there's a high probability that you might go to jail once this actually goes into effect if you continue to practice because it is a felony and once you have a felony you're in trouble anyway so at least right now it was a misdemeanor the same law is still applied all they were doing was changing this one word to felony and so it was a misdemeanor at that point in time which they could I guess go back and try to get a $500 fine from you or something like that but the question becomes in either case who wants to be first who wants to be the first one to go and try that out and if you really wanna know if you refer to port scanning how many people know what I mean by that so in port scanning in 2000 I was the first person arrested for port scanning I was working for a government agency and scanned the ISP that actually supplied service to the government agency and next thing I know I was arrested and so in Theodore has their new in-map book out how many bought Theodore's book no he sold out really fast so you know that's only two, three people have it but page 14 and 15 of his book applies to me it's all about a portion of my story going through this so if anybody bought the book and wants me to sign it I'll do it but what you need to do is go get Theodore's signature too so and convince him to print another 1,000 books or something it's a great book so anyway whoever wants to be first that's what you gotta do and the other thing is too is to defend my case for something who thinks port scanning is illegal that it's illegal, illegal you're okay with it being illegal? Okay, it's illegal in South Carolina and is it illegal anywhere else anybody knows them? Florida, port scanning is illegal in Florida okay what's that? you can marry your sister in South Carolina but port scanning is illegal okay okay so just so you know for me to defend my case for something that I would have never in 2000 declared illegal it cost me a hundred thousand dollars so even though I'm right I won it was released and basically they declared it wasn't a crime and if you actually look that up you'll actually see the judge says port scanning is not illegal and so they say it's not a crime so that's what it's gonna cost you if you're gonna be first if you get charged with a felony cause you gotta go through a number of different things and you're also going to be like trying to sue like a board a representative of the state and that's a big deal too so I wanna show you what the law looked like basically right now private investigations is a business of obtaining furnishing evidence blah blah blah with the relation to background identity habits conduct business employment occupation assets I mean this is pretty much everything I mean who has a computer that you don't think that's gonna tell something about you every time I look at a computer and deal with a case I can tell a number of different things about somebody just from the way they type or what they look at so and if that's not one of those I don't know what is so basically that's what they're declaring yes I believe computer security applies to this a lot but every time I talk about computer security with regards to this I get a number of arguments because you have a different set that you're dealing with so for instance if you work for AT&T and you're doing a pen test in your own company in a lot of cases you're completely fine and you're legal but if you're ISS and you're doing a pen test for a third party company and you discover these things but the question comes down to is it gonna be used for a legal purpose that's the ultimate thing if it's coming down to being used for a legal purpose you may not know that it's gonna be used for a legal purpose when you start so you may end up having a case so for instance somebody comes to you and says oh I just wanna know what happened on this computer but it's not gonna be going to court and so when you look at it and you go okay fine I see this guy was looking at porn and then the person who you reported to goes and fires the guy now he may not be wanting to take it to court but then the guy that got fired now says oh well I don't like how you did this and you treated me wrong I'm now gonna sue you now you're going to court so did you now commit a crime even though they declared that maybe it wasn't gonna go to court so you got a gray area there you gotta deal with and that's a big problem too so cause it's not well defined from that standpoint but yeah security applies to this a lot and in Texas to actually define it so the security of evidence in the course of the business to use before a court board officer blah blah blah so this is the defining point if you're gonna use this for some reason and of course a board or you know an officer or somebody could also be an especially investigating committee inside of a company but if you suck at computer forensics at least if you get your PI license you can now become a bodyguard so not a bounty hunter, a bodyguard there's a different license for the bounty hunter thing so yes sir again some of that is a gray area but in most cases for electronic he asked if how does it apply to electronic discovery in a lot of cases it's the same thing in other cases the electronic discovery component is actually working inside of the law firm and if you are an employee of the law firm and only that law firm, you are covered, you are fine if you are a third party and you're doing discovery you may have another problem so yes there is some gray area again where it's not easily defined and I've seen it in other states where it has become a problem so unless you only work for one company if you're only working for like AT&T but then when you wanna go third party he's saying get your PI license or you're fucked that's what he said so yes pretty much unless, you know if you work for AT&T and you work inside I'm just using AT&T as I'm not related or officially you know but that's just the point is that if you're inside a company you're okay for just doing it for that company when you step outside of that company and you wanna do it on the weekends for yourself you wanna start your own company or do something else like that now you have to look at what your requirements are to be a PI and whether or not you actually fit into that or you've gotta spend two years working for a PI before you become one or if you're ex law enforcement or something like that so yes so basically this is a list of the qualifications for Georgia that if you wanted to become one the points that I'm trying to make here is that you have to work for a detective agency in Georgia for two years Michigan is three years you know each state has their own list and then the other thing is at least two years experience as a supervisor administrator in in-house investigations and I can clarify that typically that does not mean IT investigations there's some things coming up just in a minute but ultimately they mean the security guard who sits behind the counter looking at the little video screen watching you come through the door that's what they mean he is the security administrator in-house investigator that's who they mean not you sitting there at your computer looking at stuff they may allow you the board may rule that you are okay with your skills but typically not so much so and then your other option is obviously you're already been a law enforcement which you know how many law enforcement guys are working only on computers so or four-year degree in criminal justice how many people got that yeah all right we got two or three people we can call spot the Fed so I just want to say it's something about some other states so like Nevada has a similar requirement but this is one of those where someone actually question them about whether or not IT investigations applies to being able to get your license just because you've been doing computer security and they basically said they do not count computer forensics towards the required experience for a private investigator so they have clarified at least on one front you might have to go state by state to ask them it may be different in each state but I'm just saying there's so many variations they want to have it both ways they want to buy you but you're basically paying them to be your friend that's what's happening here so all right so and then I was going to say from a standpoint of the people that this applies to it does not apply there's actually specifications in the law that say it doesn't apply to these people so for instance it doesn't apply to like an insurance agent or an insurance broker or someone who does some credit card stuff like choice point or something people who actually have sold your information anyway regardless of that I'm just pointing that out that it doesn't apply to any of these people but they basically forgot to exclude CPAs and other professional licensed organizations they ignored them altogether they just didn't mention them at all so now if you're going to change the law that's going to be a big deal because now those people aren't one of the above that the law applies to even though they should have been excluded so basically when it's sitting on the governor's desk this is the point is that the bill basically passed House to Senate it's sitting on the governor's desk and it didn't go into effect immediately so it wasn't a law yet so the governor has an option to veto the law before it becomes a law which didn't happen in Michigan it just went into effect so bam you're there so of course I find this out and it's only like two days later so it's like April 6th or something like that and I made a Guglian phone calls and emails and called everybody I knew on the planet and then basically this basically this is what would have happened if we were not able to get this law vetoed so basically we're looking at the fact that we could be imprisoned for not less than two years five years it's a felony and you get your fine so of course I'm calling everybody I know trying to get rid of this thing so I see now I am not on like the list of things that the president of the board of PIs or the president of GAPI which is the Georgia Private Investigators Association we're sending out so people started foreign me these things as they were getting them they're like now all of a sudden everybody's up in arms and they're my friends so now they're sending me things to help me try to fight this in April 2006 so I got this and basically it says you know the governor's office I heard from today blah blah blah that the that this bill HB 1259 has perceived unintended consequences and if we don't hurry up and do something basically what's gonna end up happening is that we're going to have no hope of getting this bill through so they got more than a hundred emails and phone calls and it's his guess how this got started blah blah blah as much as anybody else's so basically he lost that basically got defeated hundreds and hundreds of people CPAs groups of people had called in and the law got vetoed uh... so at least it you know in this phase it's not me alone hundreds of other people got involved so at least from that standpoint you guys at least can make a difference by making people aware and just badgering people to death for days and days and days so i'd we did this in about two weeks so we got lucky yes it's a brute force brute force with dial up that's how you do it because later on i heard that they said they got no emails well obviously that's not true so somebody got rid of those but the hundreds of phone calls they couldn't get rid of okay because there was at least a thousand emails that i know of so yes well as soon as i got the cpa is involved the cpa they basically blasted them to death so and then there was some meeting in the cpa's got invited to with the governor that i didn't get invited to but anyway so so basically this is what the governor decided and this is what he stated as to why the the bill got vetoed it's to expand the penalties from a misdemeanor to a felony without revising the definition could result in unintended consequences therefore i vetoed the bill governor georgia and so at least from that standpoint you know cpa's and a number of other people including things like uh... you know there's a number of different categories of things like maybe dna testing labs or something that may be affected by these things who don't have a professional license don't have a doctor on staff or something like that uh... so there was a lot of others i had heard about but some people just viewed this as okay we defeated them and we're done we don't have to be computer you know i have to become a p i or something like that they misunderstand that all that changed was the one word from a misdemeanor to felony that's what changed they're still saying and there is an ht c i a video on the day after it was videoed where uh... the president of of gappy and or the president of the georgia board of private investigators and the senator that sponsored this bill showed up basically and had a discussion and basically told us all uh... they started out the conversation by saying we didn't intend to affect any of you none of you are going to be affected by this and by the end of the conversation they kind of switch roles and said you all have basically committed a misdemeanor crime and so you're just upset because now it's going to be a felony so you guys can all watch this video i swear it's out there are all publishes not out there off i've got it so so that's basically the point is that again it's you know refer reports came who wants to be first who wants to be the first person to challenge this they wanted to get it accepted anyway even with these other in you know consequences they got beat it so so at least from a standpoint of the other fields that may be affected you got handwriting analysis already mentioned medical testing labs uh... i mean if they don't meet this qualification i don't know who does they take money their third party you science to tell the person has a habit that's pretty straightforward right there oh he's a drug yeah okay so so anyway they if they don't have a doctor on staff not professional license it could be a problem telecom investigators i mean they they're third party typically because they're they're specialized they may move from one area to another depending on who's hiring them you got first forensic photographers i mean a bridge falls down they go take a picture and then they come back to try to use it in court they don't have a professional license there's no i'm a professional forensics photographer so at least from that standpoint there may be some problems uh... and then uh... one of the senators or something send me this list uh... repo men bondsmen bounty hunters they actually have a separate license for bondsmen and bounty hunters but i don't believe it's a professional licenses one-day class you get the solicitation so there may be some other thing i don't know about repo men that one's knows a little touchy but at least from that standpoint there are others they can be confused and if you have this big a gray area and no one can decide i call that a big problem so this is what we try to do about it over the next year a bunch of us who are leaders in the field some people from large companies that i you guys would know if i named them basically we created this group that's called digital work forensics working group and we got the senator who originally submitted the bill for the p i board to say that he would work with us that he would work with us instead of the p i board and he would submit a law on behalf of us if we wrote one to either create or try to do something maybe with a new board or to submit a law that basically excluded us or whatever we wanted to try to write if it was if it was feasible and logical he would submit it the date that you had to submit these things all the sudden even though we wrote a bill we sent it to him it was all confirmed he says i got it we're good to go he submitted the p i bill again the next day the original one with some changes to it that now actually declared that we were digital forensics people were now involved so so basically i'm like what the heck happened here how did he just all of a sudden stab us in the back turn around you waited a year and delayed us by year so i sent this to one of the house g o p s who was kind of a friend of mine who's actually talked to me several times about this issue he says i spoke to all brief on is a lobbyist for the private detectives tonight and told him i was interested in this issue and suggested that we have a meeting of all parties to it to talk about this bill basically and he agreed and this is the first time i'd seen this guy's name so i'm like you know i'm curious about this albry volanes guy cuz is he the is he related to john volanes the president of the private investigation board hmm bam they are brothers so i guess not i'm learning a lot about the political system as we go cuz let's face it you know as computer guys most of us what's that that's funny so as a computer guy most of us just go final really care what they pass as far as a law we work the system we figure out a way around it we do what we got to do well now this is a prime example of us not being able to there you go it is on the dvd by their cd that you got from defconn as well so it's on there i've published this and on many boards yes there you go so but you know this bother me quite a bit you know is it illegal probably not i mean that he's a lawyer and he was hired by the private investigators board but here he is trying to pass laws and get senators and stuff to agree with him to for to benefit his brother directly so and help his businesses that seems a little a conflict of interest to me but i don't know so anyway this was the new bill that was submitted it's called house bill five oh four this has been what was submitted the last two years it did die on vine this last time no one uh... they didn't vote on it or do anything i can tell you it's going to come back i know it's going to come back especially now that michigan has passed this law because what happens is the states go hey you know these guys passed the law and uh... it's also a felony in in texas but uh... there's a couple of states south carolina but uh... there's some problems there obviously with uh... if they passed the law now you've got a start you know all the other people are starting to say well we're applying to the national border doing what they're supposed to do let's go do the same thing they did it we need to do it so that's what's happening here is basically they submitted this house bill five oh four for the last two years and it basically says that it's uh... anybody who's you know information including but not limited to any type of digital or electronics information so this point on now they're not even just saying computer forensics now they're saying anything so that does include pen testing and other stuff like that or uh... you know who knows maybe you know check twenty one or something like that because now it's all digital and there's a number of things now where things are going to be applied because they're digital so we may start having some problems there yeah i mean it could be anything that's used for legal purpose obviously there's a lot more to this so you need to look up house bill five oh four great it uh... and it didn't pass so they're gonna modify it and then resubmit it again but uh... but at least from this standpoint yes it could be anything that has to do with digital electronic information that's for the other three categories going to be in the court or blah blah blah so so on and so on so in this time they did specifically exclude professional practices so anybody else who has a license in some other field that is a professional license by the board they basically nullified that issue they eliminated corporations and things like that so basically now they've limited to the scope of just third parties so now it's the companies who are reselling their skills to someone else those are the only ones now that are in trouble according to the new definitions so this is uh... i pulled this from in the website is over here in the corner investigation uh... investigation dot com this is uh... a really good site they have a whole map up of letters this this uh... guy mark kessler basically ascent uh... a letter to all the states asking them whether or not computer forensics people have to be private investigators and this is just one clip from the one from georgia and so even though technically like i said they've only changed the word from or tried to change it from a misdemeanor felony they're stating right here clearly that the board does require computer forensics firms to be taken in technicians to be licensed to perform their duties to the public blah blah blah so this is like your written information for that and there's other states up there on that list if you go to that they have like a map and a whole bunch of letters and you know what they say keep in mind some of them may be outdated now because they may have changed since the letter was submitted to them or written back to them because it takes the state like a year to write a letter so so let's talk about some of the various states some of the other states i know of things that are going on so uh... south carolina says it requires a license and we'll hunt you down i've actually heard something along the lines of the a g is basically said if we ship evidence out of here and it goes someplace else and you investigate it even if it's in your own state that we're gonna hunt you down that's not a quote so you guys have to hunt that down on your own if you want to find out what that is so i'm not saying that it's a hundred percent accurate from that standpoint that's just one that i have heard through the great mind so you follow up with that then you've got a couple of things like alabama alaska missouri they don't have a state p i licensing board but they have cities that have the requirement so now if you're going to get a license you have to pay attention to what city you're in maybe one city you don't have to have one in another city you do so and if there's two cities that require me to get two different licenses that could be a big problem especially in something as diverse as something like alaska i mean how many you know how many different cities are going to go to the work in to you know where's your work gonna come from as a third party then you have a south dakota has no p i license but has a business license i mean this is how screwed up some things are i mean you know from one state to another you have no idea what you're dealing with so if you're going to be dealing with digital stuff you may be crossing state boundaries in most cases because who knows where it comes from and if you're crossing the state boundary now you got to comply that state even if it sometimes just a connection out of that state so washington state says if you interview people they don't clarify what interview means but if you interview somebody you have to be a p i so what does that mean uh... interview interrogate in most cases it just means you talk to somebody so client calls you and says uh... my son's missing and can you help and you go over and look at their computer and you take ten dollars so now you've interviewed them now you have to be a p i but if a lawyer hired you and he talked to the client never talked to you and gave you the computer and you investigated it then you're probably okay again not your lawyer so here's some new developments in north carolina recently some of you may read about this thing because it was widely published that there was a big problem going on in north carolina and i was aware of every step of the way here uh... and they had this meeting that basically there was this whole thing that somebody says okay week we all sat down and we all talk to everybody and the state now has agreed that we all need a separate license that computer forensics is different and to me i'm looking at this going something doesn't make sense here you know who do they sit down with it turns out they sat down with the p i board the p i board is the same people that they sat down with to say all we now we need a separate license and they said the p i board supposedly agreed so what does that mean it the p i work in only affect their own license so therefore they may create another category inside their own license you still have to be p i and the clarification i've heard several times is that there's already p i's who already doing the job of computer forensics and if you create a separate license they're not going to vote to say okay let's have a separate license and i have to go get some more education to do something else so i can get the separate license to do computer forensics so i've already heard through the great on a number of times that the current p i's are not going to vote on having to change their own license in order for the current people to have to be in other words they're paying for you you have to pay to be their friend they're not paying to try to be your friend saying it isn't a fraternity or anything so at least from that standpoint you've got some issues the other thing is is that if it's the p i board again that they've submitted this thing to it sounds exactly like what happened to us in georgia in georgia we've got to work with that representative the representatives working with the p i board so we kind of got stabbed in the back so that's probably what's going to happen here i hope it doesn't i hope they're able to actually create their own but they only got the agreement of the p i board not some state legislator or not some other uh... group of representatives so that i know of so that's going to be a big problem so then you got delaware where it's confusing because i actually pulled this from the law basically an investigator or agency shall not include any person employed as a computer forensic specialist so they're saying that p i isn't does not include a person who is who is you know physically uh... computer forensics person but then we got this letter from you know dot mister kessler again this has delaware actually states you have to have a license so who's right i mean delaware sends one the state says another thing in the law so another great area somebody's gonna have to fight on and it's completely confusing so uh... andy rozen how many people know who andy rozen is okay so uh... basically he created smart and he basically uh... hit as our data uh... he's one of the he's one of the brightest and i consider him to be like the grandfather of computer forensics and he's one of the brightest guys i know and he basically had to go and get a p i license and this is what his statement was is that the license had nothing to do with ethics computers chain of custody evidence uh... anything he's involved in it had to do with guard dogs and administrative regulations that's what his test was on so this starting to get a little bit of surd especially since this is all this guy does is computer forensics right software forensic software so and this comes from castler's notebook and the reason that i bring in this one up is because if you look at this particular paragraph however if the computer forensic analysis analyst were to go to follow a digital trail outside of a company it contracted with in order to find the nature location or identity of an intruder they must be licensed private investigator so the first part they say well if you're hired by company and you work inside the four walls of that company you are completely fine and they actually declare if you're actually looking for somebody some intruder on your server so at least from that standpoint they're saying find your good inside the own company but as soon as you connect to something else what does that mean a dns server if i type ping yahoo because i got something from up does that mean that now i've got a p of p i that's what this says as soon as you connect to anything outside to identify the intruder you now have a problem so again private investigator now it's gotten worse because now mostly probably heard about this one how many read this basically right now is the board has sent or the state of texas has sent letters to all the computer repair shops in texas that says they're now in violation or maybe in violation of the law and that now they have to quit their business and go get a p i license which takes three years before you come back to repair computers again that's that's really literally the geek squad i understand dot a copy of this letter that says that they physically have to go be or that they may be in violation of the law del actually contracts third parties in most cases they're not del doesn't actually technically in most cases have their own people that i know of that actually send people anybody who does it for third party that's always a problem uh... e d s i s s delightant to do it too may be the worst situation to keep an expert like in another location and when they need them they ship them to the state that they need so at least from that standpoint at least as my understanding of it that they may have to have a license in every state okay he says that the they sent out a clarification letter last week which i must have missed that says that they are not requiring computer repair shops as probably because all computer repair shops got together and started a lawsuit against the board of private investigators so you know right but you still start getting some of these great areas for somebody have an argument and michigan they did not leave any gray area or whatsoever from that standpoint they basically say computer forensics is this and so computer forensics is now listed in their law and it gets worse you cannot hold a license for your company so how many people are under twenty five years old okay some of you i started my first company was twenty three so i you cannot hold the license for your company as a p i even if you meet all the other qualifications unless you're twenty five years old so you can go get shot at in war you can drink you go strip clubs but you can't hold the p i license with minimal education to get this uh... unless twenty five so that's it i see big problems here and then uh... you have to obviously post bond and stuff like this that starts to get too expensive stuff and then the other problem that there's confusion if you look the title of this is you know basically in the law now they say a period of not less than three years following this on a full-time basis and then you read the bottom part investigation law criminal justice or computer forensic or other computer forensics industry sort of certificated study that is that's a real word it's actually real words certificate certificate of studies is not a bush and again thing here uh... i'm the desider uh... anyway so the computer for extra certificates that but the problem is is now not only who has a certificate of study that's three years i mean anybody have a computer forensics that's three years i don't think so and then the other problems that is acceptable to the department that's an opinion i mean like some guys in the top this week of that he's good i like them and next week is all know he's a competitor because i'm a p i and i'm in business too because i'm on the board and he's a competitor i want him so they kick you to the curb and again this is also the same thing with ethics boards and stuff like that they think you've done something wrong they get to also revoke your license some issues there and then i got this uh... this is a friend of mine who actually owns a company there who had to shut down his company on may twenty eight and he keeps asking and has still up till now been asking michigan what you need in the certificate of study to uh... to be a p i and they keep saying we really aren't sure yet we don't know we haven't decided what will qualify so basically they made a law passed it and they have no clue what they're going to do about who's going to be accepted well who's that professional licenses alright so california basically uh... they basically stated that the category of things is from the a g so it's basically coming down the line and saying that you do not have to be a com a p i to be a computer friends sky unless you interview people again so once you interview people then you got a problem alright so i pretty much decided at this point that i got to become a private investigator so i'm going to go take the test so i sent off some information to go find out what i need to study to become a p i so this is from the vice president of the gappy they uh... georgia association private investigators you're correct there is no official study guide or study material available for the private detective exam by georgia you know blah blah blah the state requires the test but they give you no guidance or anyway shape or form to actually find out what the heck is on the test no one wrote a study guide in forty years that they've been around to say professional license i'm gonna start a professional license i'm not gonna have qualifications for what that is so i said this to my friend the senator he goes man this is ridiculous do you mind if i share this with secretary state they did you not see secretary state gives this test i hope he helps out i hope it works out but don't they know i was pretty sure that they would know they don't have like a book they're selling this is a study guide you can make money there you know sell book yeah their whole music certainly well this is not just in georgia trust me it happens state-by-state so here's just a quick idea about what's on the exam they give you three sample questions that's all they give you that's there's nothing nothing else other than say what you need but anyway so weapons calibers blah blah blah we gotta move on because we cut short here so then you go through this is basically you know a number of different things with regards to whether or not this question's leading or something so i get to this how many times is computer appear big fat zero none not the word computer anywhere on that test at all there is no requirement for you to have to do anything this is what they tell you your subject area is even though they don't give you a study guide so you get legal information observation surveillance guns evidence interrogating people so i googled all those put all those words into google and this is what i got and just so you got interrogation to get your guard dogs from texas over there you got some guns and this is called client relations so basically after you're done with all this this is what it's cost me basically this is your breakdown of two years of you know year by year what's gonna cost you so you're gonna spend about two grand in your first year between insurance on all the other stuff plus uh... eighty hours of your time and a number of other things working for someone else while you are making no minimum wage because if they know they got you i mean what are they gonna pay you they're not going to pay you what you're making so you're gonna go through this process make a lot less money and then each year after you finally are done this is about what's gonna cost you and then you've got you know forty hours or whatever continuing education so my real question now after you've all gone through all this fighting gone through weeks and weeks of training and spent a lot of money on your own uh... you know who's gonna who's gonna deal with certifications if certifications basically this could become the death of some of those certifications because who's gonna say hey i got a cce while you're on the stand if that's you know maybe that's a second thing the first things gonna become and i understand as a difference between you know how these things work in whatever but and that you know certification does not necessarily give you qualifications for your licensing and things like that but this is really a big question because now it's kind of destroying these uh... so my my final thing basically here is the things that you can do because that's what i really want to get out of this because we we need to change the world that's really the point we've been sitting around and not paying attention and not doing stuff and work in the system and now they're getting to where they're changing the laws to affect our jobs in our businesses so the first thing is you need to start thinking about whether or not you think we need a special license because if some tech people are not starting to work on politicians and start to become politicians we're not gonna make any advances you cannot make a change just because you talk to a board or you're hoping that that's gonna happen until somebody gets in there and actually starts to take over some of these things that actually understands technology we're gonna have the tubes the internet so that's basically what we're gonna have every time we turn around people that have no clue about what we're doing and i want to make sure that you understand that you know you don't have to wait for somebody else to do it you're somebody yourself if you're not paying attention to your state and reading these things and go to that legislation page because if you're not paying attention legislation page that's where you're gonna lose and then i got my references and blah blah blah this is what kessler's notebook looks like you guys can go look at your own and find out what that letter is and that's it for me