[Dshield] Forensics to become a felony in Georgia

Frank Knobbe frank at knobbe.us
Thu Apr 27 19:06:16 GMT 2006


On Thu, 2006-04-27 at 12:21 -0400, Kenneth Coney wrote:
> I have seen this before and have dealt with it before.  More and more 
> states are moving in this direction.  The best solution is to simply 
> pick up the additional license(s) if one can and deduct the costs at tax 
> time.  Render unto Caesar, etc. 

Errr.... no. It sounds like you don't understand the subject matter well
enough to make such assertion.

There are several exceptions that allow expert witnesses to testify (and
I'm not talking about Daubert/Fry related issues). Typically you are
hired by legal counsel to testify on the subject matter for his client.
From what I understand, you don't need a license for that. If counsel
sees you fit and the judge accepts you, then that's all that's needed.

There was a posting in the Pentest mail list that went into more details
on those exception. I have not read these exceptions myself, but
throwing in the towel like you did is the completely unjustified. 

Below is the other email, forwarded without permission as it was posted
to a public list. I had replied to it since I objections to the idea
that "opinion" should not appear. That's wrong. The jury and/or judge
base their assessment on your opinion on the subject matter, which is of
course based on facts. (not your opinion about the parties and other
stuff of course). Other than that, I think Craig is right on.

Regards,
Frank

---8<---

Date: Thu, 27 Apr 2006 15:34:49 +1000
From: "Craig Wright" 
To: "Brian Anderson", <pen-test at securityfocus.com>


Hello,
More FUD. Statute is not the be all and end all in law. The US is a
common law country. Convention and interpreted rules change the way that
statute is read.

Lots of people try to read many things into the law to protect their own
personal interests. This is the nature of the world. There are rules of
evidence in all jurisdictions. The nature of an expert witness is to act
as a "friend of the court".=0D

"Just the facts Mam..."
The idea is that you stick to the facts. The moment you get into opinion
is where issues may arise. Expert testimony is about fact. Not
opinion.=0D

People who call themselves Computer Forensic experts abound. Digital
forensics is a science; it needs to be treated as such. PI licenses are
not needed if you actually stick to the role you are engaged to do and
remember that.

The Georgia statute states "An attorney at law or a bona fide legal
assistant in performing his or her duties" is excluded. There are two
instances where a person (who is an expert as defined in law) may be
called:
1       Private law cases (Contracts, Property, Torts etc, ie Civil
action)
2       Criminal Law cases (cases that are punitive in nature under a
criminal inditement process).

The Georgia law is applicable to criminal law cases - and ONLY criminal
law cases.

If you are hired by the state (i.e. Police, AG etc) - you are covered
under exemption. If you are hired by the defence, you are hired by the
attorney. This means that you also become covered under the rule unless
you are ignorant of judicial requirements and start spouting opinion
without a solid factual basis.=0D

The role of the expert again is fact. The jury makes the determination.
As an expert you have NO opinion (or at least should have no opinion).
You find and present the facts and nothing but the facts.

"The securing of evidence in the course of the private detective
business" is important. It is crucial that the preamble and case law is
read. Before mouthing off about how the law is making us all criminals,
try to understand the law.=0D

Regards,
Craig

---8<---
-- 
It is said that the Internet is a public utility. As such, it is best
compared to a sewer. A big, fat pipe with a bunch of crap sloshing
against your ports.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: This is a digitally signed message part
Url : http://www.dshield.org/pipermail/list/attachments/20060427/8df152a5/attachment.bin


More information about the list mailing list