Add a Comment Now - We Want to Hear From You
Series Summary and Editorial
Part One: Interview with Texas State Rep. Joe Driver
Part Two: Interview with Matt Miller, Institute for Justice
Part Three: Interview with Capt. RenEarl Bowie, Texas Private Security Bureau
by Brian Boyko
Editor, Network Performance Daily
We’ve written three stories and conducted three interviews regarding HB2833. The first was with the author of the law, Texas State Representative Joe Driver, the second with Matt Miller of the Institute for Justice, and the third with Texas Private Security Bureau Captain RenEarl Bowie.
Here is our editorial summary:
HB2833, the law designed to make changes to laws regarding private investigation but has PC and Network techs worried that their work may now be illegal, has caused confusion and worry from normal people doing normal jobs in a normal manner. Whatever the original intent of the law, it is clear to see from its effects that the law itself is poorly written.
Ultimately, words like “open to interpretation” and “case-by-case basis” are not words you want to use when describing either the meaning of, or enforcement of, the law.
So, where did things go wrong? I think the man problem was a key misunderstood concept by Texas State Rep. Driver when he wrote the law. It is clear from the interview with him that he believes that there is a clear and well defined line between “retrieval of data” and “investigation.”
“’Review, analyze, and investigate’ are the three key words, in my opinion, that drive the need for people to have some kind of license. Because if they're doing some of that, then they don't need to be - it doesn't need to be just anybody able to do that - they need to have somebody that has a security license. But if someone's just retrieving information and providing information for someone who is going to analyze, to use one of the words, then that's just a regular computer repair person.” – Rep. Driver.
But what Rep. Driver simply did not realize is that in the practical realities of IT, no such line exists. Any and every interaction that any IT person has with a computer requires some sort of “review, investigation and analysis,” whether it’s simple troubleshooting or complex network latency optimization.
I can see where Rep. Driver was going with the law and what his intent was when writing it – rooting around through someone’s Windows Recycle Bin can be just as invasive as rooting around in somebody’s trash.
But rooting around in the guts of a computer to discover the cause of a malware infection is different from rooting around in the guts of a computer to discover infidelity. However, instead of making the criteria of “investigation” the purpose and use to which the information could be put, the law makes the criteria the way that the information is stored – “computer-based data not available to the public.” The end result is that the net was cast too widely.
Compounding this problem is the interpretation provided by the Texas State Private Security Bureau of the law – a literal one.
“Computer repair or support services should be aware that if they offer to perform investigative services… they must be licensed as investigators” – Texas Private Security Bureau Opinion Summary.
Unlike the law itself, the opinion summary is an unambiguous statement, and while Capt. Bowie may say that the law will be interpreted on a “case-by-case” basis, that is not what is in the official statement of opinion.
As for the court case brought by the Institute for Justice – unfortunately, the Institute for Justice seems to want to fight this case on Constitutional grounds. However, that will be a hard sell, as qualifications and licensing are clearly powers that states exercise, from state bar associations for lawyers, and state medical boards for doctors. If the state of Texas wants to make a PI license a requirement for PC repair techs, it certainly has the power to do so. It may be absurd, but absurdity is not unconstitutional.
So, where does that leave technical practitioners like network engineers and PC repair gurus? As a practical matter, I think most people are going to continue going about this, “business-as-usual” style and make a stink only after the law is enforced on some, most likely unsuspecting, tech somewhere in Texas.
The good news is that I think that it is indeed possible to clarify and change the law through the legislative process – Rep. Driver has stated that he would indeed make changes to the law if it needs clarification or amendment.
It clearly does.
Comments
It astounds me that we have people in high places both in government and in industry that are clueless and devoid of any real education. Usually their lack of ability becomes evident when they craft written documents. Specific reading and interpretation are basic skills that need to be encouraged even in the early years of grade school.
Posted by: jim sadler | July 9, 2008 09:22 PM
Ok, but that (to me) raises completely new questions. How is it possible that laws as broken as these are proposed and then accepted in Texas. Why is necessary to make a "stink" after laws have been accepted; where I come from, bad laws are heavily opposed until amended. And where does the need come from to micro-manage the society with laws like these (perhaps this is some sort of "official PI protection act")? To me, this is just one strange story of democracy not really working well, pretty bad in all.
Posted by: Jaap | July 10, 2008 01:32 AM
Well that sucks!
Posted by: Doc | July 10, 2008 07:24 AM
I believe the below is a likely scenario:
Some computer repair tech will find evidence of a crime - child porn, credit card numbers - on a customer's PC and report it to the police. The criminal's lawyer(s) will then invoke this law to have the case thrown out because the repair tech was not appropriately licensed.
Posted by: Jasen | July 10, 2008 07:52 AM
A PC repair tech shouldn't be *looking* for the evidence of criminal activity, but if he happens upon it as part of his normal duties, then he should report it to the police, just as if someone in another line of work came upon evidence of a crime. If the PC tech is offering forensic data recovery/analysis, then *of course* he should have a PI license, as well as a certification from a computer forensics organization.
Posted by: Smokey Behr | July 10, 2008 02:31 PM
Brian, thank you for the excellent interviews and the even better summary. If you speak with representative Driver again, please ask him why someone with a broad and deep understanding of computer technology wasn't asked to evaluate the law's language. Surely, if that had been done, the language would have been made more specific.
Posted by: Duane in Fort Worth | July 10, 2008 03:13 PM
Most Texas lawmakers seem to be on the ball, so I'm surprised there seems to be a lack of forethought to some of the actual wording;
(B) the identity, habits, business, occupation, knowledge, efficiency, loyalty, movement, location, affiliations, associations, transactions, acts, reputation, or character of a person;
So, the checker at GroceryStoreInc asking me for my 'loyalty' card so they can use my 'transactions' to obtain my purchasing 'habits' and allow their company to analyze that data via the 'not available to the public' database would be breaking the law?
Since they are required by management to ask for it, seems they have accepted employment that includes obtaining such information.
Section (1)(b) does not exclude this, it _includes_ actually using the data collected, also known as data-mining.
And, of course, this particular passage makes many informants automatically convictable of a Class A misdemeanor. Strangely enough, it would also make the officer convictable.
Read a little farther down;
§ 1702.105. ALARM SYSTEMS COMPANY. A person acts as an
alarm systems company for the purposes of this chapter if the person
sells, installs, services, monitors, or responds to an alarm system
or detection device.
If I look at my window when my neighbors car alarm goes off, have I responded? If I yell at the guy who is trying to break into the car, have I responded? It actually seems if a bird set the alarm off and I scare the bird off opening my door to check it out, I could be charged. Heck, if I call the cops to complain about the alarm, it could be considered a response.
Yes, I'm being a bit absurd there, but, that is the way the law reads.
There are obviously a few places where it needs clearer, more precise wording.
Posted by: Paul | July 14, 2008 03:19 AM
The Texas Department of Public Safety's Private Security Bureau website was just updated, at http://www.txdps. state.tx. us/psb/AgendaIte mXIV.pdf, to clarify that only computer repair technicians who are seeking computer data to use as evidence in a criminal or civil hearing must be licensed by the Bureau under the Texas Private Security Act (Chapter 1702, Texas Occupations Code). The update is entitled "Minutes of July 23, 2008 Private Security Board Meeting, Agenda Item XIV, Regarding Computer Repair Technicians."
The portion of the 23 July Private Security Board minutes that are now considered policy of the Private Security Bureau when enforcing the forensic computer repair issue is as follows:
"(a) Information obtained through the review and analysis of the content of computer-based data with the intent to use such data a evidence in a criminal or civil hearing must be obtained and furnished by an investigations company license under the Act or by an individual exempted from licensure under §1702.323 (a) of the Act. (b) The repair or maintenance of a computer does not require licensing under the Act, even if during the course of the repair or maintenance the person discovers information described by §1702.104 (a) (1)."
The Texas Occupations Code can be found online at http://tlo2. tlc.state. tx.us/statutes/ oc.toc.htm.
Posted by: Stacy Flores | August 10, 2008 12:18 AM
I agree, this is a poorly written law.
The language of the law could be interpreted to require companies that produce Anti-Virus programs that can detect unknown malware infections that allow submission for further analysis to also need PI licenses.
Another law that is equally poorly written is the new Texas e-waste law:
http://tceq.state.tx.us/assistance/P2Recycle/electronics/computer-recycling.html
The problems I have with this law are mainly from a retailer point-of-view:
The definition of retailer: states ANYONE selling in or into Texas, with no language excluding sales representatives, wholesale warehouse distributors, and businesses that may otherwise be located in Texas but do not sell to Texas entities due to territorial limitations. The person I talked to at TCEQ told me flat out that if stock of a non-compliant product is found to be on the premises within Texas fines can be levied. This effectively prevents me from selling a product that may be compliant in another state, if I cannot have it directly drop-shipped to them.
The other problems I see with the law under the manufacturer's responsibilities only requires the manufacturer's recovery plan to be offered to individuals and home based business consumers. Yet the definition of retailer prohibits sales of non-compliant products to all Texas entities no mater what size.
The other problem with these e-waste laws, is that they require a manufacturer to have their recovery program registered with the state regardless of already having a program of their own that meets or exceeds the compliance requirements in place.
I talked to one manufacturer I represent, and their response was we already meet federal and international regulations and they do, I told them these states require that you be listed on their list. No wonder nothing is being made in this country anymore.
These laws are especially hard on entrepreneurs, This country was built by entrepreneurs and small businesses, you have to start small before you can become big business. Who do these politicians think pay the tax money that they get to over spend?
Exo
Posted by: Exothermic Reaction | August 24, 2008 02:21 AM
Hi Brian Boyko ........ it was an good interview .... As Stacy Flores said it was a poor law and it is like that we cannot change .This blog is amazing. It’s not only interesting but also enlightening. I have not come across such an interesting article for a long time. I m happy to know that good writers like you still exist.
Posted by: Mark | December 3, 2009 12:33 AM