by: Rodney Tolentino, Associate Editor, MTTLR
There is a current trend among states, including Texas, Georgia and South Carolina, to require computer forensic technicians to be licensed by state agencies as private investigators.1 On May 28, 2008, Michigan joined these states in requiring persons performing computer forensic services to be licensed as private investigators.2 Under the Professional Investigator Licensure Act,3 those who provide services regarding the “collection, investigation, analysis, and scientific examination of data held on, or retrieved from, computers . . . .”4 are required to have professional investigator licenses issued by the Department of Labor and Economic Growth before performing these services.5 If a person performs computer forensic work without being licensed, then the violator is guilty of a felony and subject to imprisonment for up to four years, a civil fine up to $25,000 or a criminal fine of up to $5,000.6
Why does this matter? The Recording Industry Association of America has been using an investigative company to help identify computer users who download songs illegally in order to file suit against those users for copyright infringement, but parties in Michigan have fought these efforts by alleging that the investigative company is unlicensed and thus conducting its investigations illegally.7 Additionally, the trend of requiring computer forensics experts to be licensed as private investigators is not ending with Michigan. The Private Protective Services Board, the state agency in North Carolina that regulates private investigators, is proposing a separate license category for “Digital Forensic Examiners” and will require 3,000 hours of digital forensics experience in order to obtain such a license.8
The American Bar Association is recommending that states refrain from requiring computer forensics experts to be licensed as private investigators.9 Among the reasons for opposing state licensing is that the licensing requirements create thorny jurisdictional issues.10 I will discuss some of the legal issues the Professional Investigation Licensure Act of Michigan raises, including due process, jurisdiction, and dormant Commerce Clause doctrine, and in what circumstances would the legislation regarding state licensing of computer forensics technicians as private investigators be permissible.
Commentators have noted that the Professional Investigation Licensure Act is so broad in its definition of “computer forensics” that it requires someone printing a Web page for use in court to be licensed as a private investigator.11 In such an application of the statute, it could be argued that the definition of “computer forensics” is too broad and thus a violation of procedural due process. “[T]he guaranty of due process, as has often been held demands only that the law shall not be unreasonable, arbitrary or capricious, and that the means selected shall have a real and substantial relation to the object sought to be attained.”12 A plaintiff burdened by this new law could argue that sanctioning someone with jail time or fines for printing out a Web page is a violation of due process because such information is easily accessible and has no “real and substantial relation” to the objection of protecting the public from incompetent private investigators.
In its recommendation the ABA poses the following hypothetical example of the jurisdictional issues the private investigation licensing regulations create: “For example, data may need to be imaged from hard drives in New York, Texas, and Michigan. Does the person performing that work need to have licenses in all three states?”13 Professor Bruce Boyden of Marquette University Law School would answer this question in the negative; he claims that states would not have jurisdiction over technicians performing computer forensic services out-of-state.14 To support this proposition, he cites Boschetto v. Hansing.15 In Boschetto, a California plaintiff purchased a car from a Wisconsin dealership through eBay and arranged to have the car delivered to California, but the Ninth Circuit held that the one-time transaction was not enough to establish the minimum contacts needed to support personal jurisdiction.16 A computer forensics expert gathering the digital information needed to identify a particular individual in a one-time transaction would not be enough to establish a “substantial connection” with the forum.17 Therefore, states that have enacted licensing statutes, such as Michigan, would be able to enforce them only on defendants with strong connections to those states.
However, if Michigan chooses to assert jurisdiction based on where the information is located, Boyden argues that the Private Investigator Licensure Act would violate the dormant Commerce Clause power.18 Requiring computer forensic technicians to be licensed as private investigators would require technicians to be licensed in all states where information could be located.19 Considering the “slim” benefit of requiring licensing for the gathering of easily attainable information, such licensing would be unduly burdensome on interstate commerce.20
Professor Allan Stein has proposed a different approach to thinking about personal jurisdiction in the Internet era, which would solve the potential dormant Commerce Clause problem. He states that, with regard to “Internet-inflicted” injuries, because the entire conduct was electronic, it is difficult to determine jurisdiction because the defendant may not have known which states would experience the results of her actions, and the defendant may not have the ability to control the reach of the conduct.21 Stein proposes that in determining whether to assert jurisdictions, courts should ask themselves how hard it would be for defendants to tailor their conduct in response to the laws of different states.22 If defendants are able to avoid jurisdiction easily and if the state has an interest in regulating the prohibited conduct, then a state court’s assertion of personal jurisdiction can be justified.23 Applying this “regulatory precision”24 approach to Michigan’s Professional Investigation Licensure Act, if technology allows an unlicensed computer forensic expert to determine with minimal burden that it is gathering information on the resident of a state that requires computer forensic technicians to be licensed as private investigators, then a state court would be justified in asserting personal jurisdiction. Emerging technologies will make it easier to avoid such jurisdictions.25
Absent such technologies, however, Boyden would argue that requiring private investigator licenses for computer forensic technicians would be a violation of dormant Commerce Clause doctrine.26 Stein also cites a case where a state statute was invalidated because the benefit from the statute could not be justified against the “extreme burden on interstate commerce.”27 Stein recognizes the conflict between states’ authority to “protect its inhabitants without excessively constraining extraterritorial conduct beyond its regulatory authority.”28
Stein’s “regulatory precision” approach, assuming the existence of technology allowing companies to avoid jurisdictions where their conduct would be illegal, would allow the states to protect its residents from abusive and unethical private investigation as it relates to computer forensics without violating the Commerce Clause.
1 ABA Section of Science & Technology Law, Recommendation 301, at 2-3 (2008), available at http://www.abanet.org/scitech/301.doc [hereinafter ABA Recommendation].
2 John Tredennick, Collecting Computer Data in the U.S.: Pick the Wrong State and You Could Wind Up in Jail, Law Technology Today, July 2008.
3 Mich. Comp. Laws § 338.821 (2008), available at http://www.legislature.mi.gov (enter 338.821 in MCL Section text box).
4 § 338.822(b), available at http://www.legislature.mi.gov (enter 338.822 in MCL Section text box).
5 § 338.823(1), available at http://www.legislature.mi.gov (enter 338.823 in MCL Section text box).
6 § 338.823(2-3), available at http://www.legislature.mi.gov (enter 338.823 in MCL Section text box).
7 See Letter of Doe #5, LaFace Records LLC v. Does 1-5 (W.D. Mich. 2008) (No. 2:07-cv-177). See also complaint to Michigan Department of Labor & Economic Group, (filed by general counsel of university alleging violation of Professional Investigator Licensure Act).
8 North Carolina Business Litigation Report, (Sept. 24, 2008).
9 ABA Recommendation, supra note 1, at 2.
10 Id. at 14.
11 See posting of Bruce E. Boyden to Marquette University Law School Faculty Blog, (Sept. 5, 2008) [hereinafter Boyden Post].
12 McAvoy v. H.B. Sherman Co., 258 N.W.2d 414, 436 (1977) (citing Nebbia v. New York, 291 U.S. 502, 525 (1934)).
13 ABA Recommendation, supra note 1, at 14.
14 See Boyden Post, supra note 11.
15 539 F.3d 1011 (9th Cir. 2008).
16 Id. at 1019.
17 See id. at 1018 n.4.
18 Boyden Post, supra note 11.
19 Id.
20 Id.
21 Allan R. Stein, Personal Jurisdiction and the Internet: Seeing Due Process Through the Lens of Regulatory Precision, 98 Nw. U. L. Rev. 411, 443 (2004).
22 Id. at 450.
23 See id. at 451-52. Stein cites the U.S. Supreme Court case Phillips Petroleum Co. v. Shutts, 472 U.S. 797 (1985), as consistent with this approach.
24 Stein, supra note 20, at 447.
25 Id. at 452.
26 See Boyden Post, supra note 11.
27 Stein, supra note 20, at 428.
28 Stein, supra note 20, at 412.
As of July 14, 2009, the NC House and Senate ratified an amended bill (Senate Bill 584) which provides a specific exclusion for Computer Forensic Professionals practicing in the State of North Carolina.
I’ve written more about the topic at my blog:
http://forensicsinreallife.wordpress.com/2009/04/17/44/
and
http://forensicsinreallife.wordpress.com/2009/07/20/senate-bill-584-licensing-for-digital-forensic-professionals-in-nc/