Licensing Digital Forensic Examiners
By Jeffrey S. Kopp and Scott R. Kaspar
In non-compete cases, often the most powerful evidence that will convince a judge to enter an injunction is computer records and files showing that an employee or former employee has illegally downloaded confidential or trade secret information on his or her way out the door. For instance, three employees of one of our clients recently quit to go work for a competitor, and on the eve of their departure they downloaded spreadsheets, cost models, forms, and customer proposals - most likely so that they could use them under their new employment. Proving what these employees were up to was critical for our client's ability to show the judge that this conduct warranted an injunction.
Often, companies do not have the capability to analyze computer data in-house, so they need to retain a forensic specialist to examine laptops, look for hidden metadata, and see whether files have been altered, copied, or deleted. Under some state private investigator licensing laws, such computer forensic examiners must be licensed as private investigators. Some state statutes, including Michigan's, go so far as to expressly include a licensing requirement for anyone who conducts "computer forensics," which is defined as the "collection, investigation, analysis, and scientific examination of data held on, or retrieved from, computers, computer networks, computer storage media, electronic devices, electronic storage media, or electronic networks, or any combination thereof." MCL § 338.822. While certain categories of people are excluded from the definition, such as in-house IT professionals, attorneys licensed in the state, and CPAs who conduct financial investigations, the majority of computer consultants that would be retained to examine a hard drive likely fall within the definition of the Act. Other states, including Florida, South Carolina, Texas, and others also either have express licensing statutes or have broad Private Investigator licensing statutes that also can be interpreted to cover computer forensic examiners.
Violation of a licensing statute at a minimum will subject the forensic examiner to a fine from the licensing state. However, the implications could be more severe, including an order from a court or from the state prohibiting the forensic examiner from testifying before a court or even possibly the exclusion of evidence. Considering these risks, it is prudent to make sure that any computer forensic examiner retained in non-compete cases is properly licensed in the state where the examination is being conducted.