Do People Who Investigate Websites Need P.I. Licenses in All 50 States?

Posted on Categories Computer Law, Legal Practice

MediaSentry Logo

The techie blogosphere is abuzz with the news that Michigan amended its private investigator licensing laws in May to add “computer forensics” to the list of activities that require a P.I. license in Michigan. This may not sound like big news, but it raises the possibility that MediaSentry, a company that gathers information on peer-to-peer filesharers for use in the RIAA’s lawsuits against online infringers, may be violating the law in several states. Given the general antipathy to the RIAA among the technorati, suddenly a large number of bloggers are interested in the arcane details of P.I. licensing requirements.

But the issues raised by the law go well beyond the RIAA lawsuits, and potentially affect any investigation of online misbehavior. Any lawsuit against an anonymous online individual begins with an attempt to identify that person. Furthermore, the definition of “computer forensics” in the Act is so broad that it includes printing out a web page for use in a lawsuit. Attorneys need to pay attention here too: the Michigan law exempts attorneys, but only if they are “admitted to practice in this state.” And other states have similar laws. So do you need a P.I. license or a bar admission in all 50 states before you can sue that defamatory blog poster?

I think the answer is no, but we’ll see what position the state regulatory authorities take. The issue raised here is one that comes up in a lot of different contexts in Internet law: where in real space does activity on the Internet occur? The position of the General Counsel of Central Michigan University, who has filed a complaint against MediaSentry, appears to be that private investigation services occur at the site of the computer holding the file or website that is being investigated.

There’s no single answer to the question of where activity occurs on the Internet; rather, in each context, the question is which of the many possible locations at issue (the server, the client, or each jurisdiction the communication passes through) has the better claim to exercise regulatory authority. In the specific context of business licenses, I think it’s a mistake to say that Internet information-gathering services are properly regulated in each forum with a server holding some of the information.

The statute at issue governs, not activities in Michigan per se, but rather the business of being a professional investigator. (“A person, firm, [etc.] shall not engage in the business of professional investigator for hire, fee, or reward, and shall not advertise his or her business to be that of professional investigator or of a professional investigator agency without first obtaining a license from the department.”) That’s wise, because a statute requiring a license to gather any information at all would likely violate the First Amendment. But is a person who gathers information off of an AOL server in Virginia really conducting business in Virginia? Certainly not for personal jurisdiction purposes; even the sale and shipment of a physical automobile on eBay to a California consumer was recently held not to be “doing business” in California. And for sales tax purposes, gathering information off of a server in the forum also wouldn’t be enough to subject the sale of that information elsewhere to sales tax in the forum.

Gathering information available on the Internet from a server in the forum seems too tenuous a connection to make that business (or lawyer) subject to licensing requirements or other business regulations in that forum. MediaSentry is located in Maryland; if Maryland decides MediaSentry needs a license, it would have every right to insist upon it. But until MediaSentry starts sending investigators into Michigan, or directly interacting with Michigan residents somehow, I don’t think the Michigan license requirements apply to it.

If Michigan takes the opposite view, that could well be subject to a dormant commerce clause challenge, as an attempt to effectively regulate behavior taking place wholly outside its borders, and as a local regulation that would have disproportionate negative impact on interstate commerce. Anyone investigating any website where the location of the server was not known would, essentially, need to be licensed everywhere the server could be, which would make garden-variety investigation of websites or emails needlessly cumbersome. And the local benefit from requiring a P.I. license for the gathering of information easily accessible on the Internet is extremely slim. So an attempt by a state to regulate ordinary out-of-state Internet data-gathering activities, carried on in preparation for a yet-to-be-filed lawsuit, should fall afoul of the commerce clause.

2 thoughts on “Do People Who Investigate Websites Need P.I. Licenses in All 50 States?”

  1. Licensing is there to protect the consumer from all kinds of professionals who, historically have screwed over the consumer. Just think of the state professional licenses that are out there. Somehow, some way, computer technicians are whining for a licensed free ride when they start doing computer evidence investigations. For whatever reasons many don’t qualify, and thus want the standards lowered because they are dealing with computer evidence. Unlicensed professionals are getting caught all over the nation, and that includes computer technicians who may think that their computer evidence work is somehow immune from licensing. Computer Forensics is definitely in need of licensing enforcement….check out James Earl Edmiston via Google for just one example of computer forensics fraud. Hey, computer techies…leave the civil and criminal investigation to the licensed professionals….

Join the Conversation

We reserve the right not to publish comments based on such concerns as redundancy, incivility, untimeliness, poor writing, etc. All comments must include the first and last name of the author in the NAME field and a valid e-mail address.

This site uses Akismet to reduce spam. Learn how your comment data is processed.