The difference between “No one will hire me” and “I am no longer professionally allowed to do this DFIR work”

A recent discussion on LinkedIn about DF/IR accountability made me realize that several people, including (or mostly…) me, were using the word “accountability” to mean entirely different things.

That’s important because

the point changes depending on which definition or perspective is being used. Some discussed individual accountability, with things like:

• “My reputation is on the line.”
• “If I do bad work, people stop hiring me.”
• “If I get destroyed on cross examination, word spreads.”
• “If my company’s reputation is ruined, I lose business.”

That type of accountability exists. Reputation, credibility, courts, examination, and market consequences matter. But that was not the point I am trying to make. 

I was referring to something narrower: Professional accountability.

More specifically:

• “What enforceable standard exists to do the work?”
• “What happens when the work is bad?”
• “Does the accountability standard depend on who signs the paycheck?”

Those are different questions. 

Another important distinction is this: administrative compliance, scientific improvement, investigative reasoning, and professional judgment are not the same thing.  A practitioner can follow a required checklist and still reach a weak or unsupported conclusion. That is why any accountability discussion has to separate compliance with a process from competence in analysis.

The Problem With Mixing Accountability Models

Part of the confusion is that we often mix together several completely different forms of accountability and treat them as interchangeable.

They overlap, but they are not the same thing. For example, losing a client is market accountability. Being fired is employer accountability. Having testimony excluded is courtroom accountability. Losing the ability to legally practice a profession is professional or regulatory accountability.

A DF/IR practitioner may lose a client and immediately obtain another one. A practitioner may leave one company and continue the same work somewhere else. A government examiner may survive repeated bad work because the agency still receives cases regardless of competence. A private examiner may survive because the work never reaches adversarial testing in court.

Public Sector Versus Private Sector

Some interpreted my comments as saying the public sector has better accountability than the private sector. That was not my point.

Attorneys and law enforcement who do DF/IR work generally must meet regulatory standards before handling legal cases or enforcing laws in those professions. But these regulations are outside of actual DF/IR work. They must know the laws and then be commissioned or licensed. Doing DF/IR often requires no profession-wide regulatory standards.

In much of private-sector DF/IR, a person may face no mandatory competency standard beyond being hired or selling the service. That does not mean private practitioners are less competent; it means the field lacks a consistent enforceable baseline. In many cases, private sector competence is exceptionally high.

In theory, the public sector, especially law enforcement, has more formal mechanisms of accountability. Whether those mechanisms work consistently in practice is a separate issue. I have personally seen public-sector personnel lose positions or commissions. I have also seen gross incompetence survive and even get promoted.

The private sector has different pressure points, and these count as real accountability too, but it is still different from professional accountability. Losing business is not the same thing as losing the legal or professional authority to continue practicing. I’ve seen a private sector examiner fired on the spot during a criminal case data collection for a major violation of standards and competence, only to be hired the next week by another company. 

The Question

The question I was actually asking is much narrower than whether accountability exists.

It is ‘If DF/IR work affects liberty, employment, money, business survival, child custody, insurance coverage, or public safety, should the accountability standard depend on whether the examiner works for a government or private entity?’

That does not automatically mean licensing is the answer or that I believe government oversight magically solves competence problems. But other professions are far ahead of DF/IR with this issue.

A city attorney is generally held to the same professional standards as a corporate attorney. A government nurse is generally held to the same standards as a private hospital nurse. The same is true across many professions where the work materially affects the public.

DF/IR is unusual because the consequences can be enormous while accountability standards remain fragmented, inconsistent, or sometimes nonexistent depending on where the practitioner works.

The Hard Part

It’s easy to find bad work in the wild. Go to enough trials, or read enough reports and appellate decisions and you’ll see enough of it. You may have even experienced it in your casework.

The difficult part is building accountability mechanisms that remove incompetence without removing competence.

Overregulation creates its own problems. A rigid licensing structure could easily exclude highly competent practitioners who built this field through investigations, testimony, research, and operational experience instead of formal academic pathways.

At the same time, pretending there is no accountability gap is also difficult to defend, especially when bad DF/IR work can affect criminal convictions, civil judgments, employment actions, business disputes, parental rights, insurance decisions, and public safety outcomes.

I am not sure anyone currently has a simple solution. Many groups are creating standards, guidelines, SOPs, and best practices with the expectation or assumption that practitioners will accept and follow them. But without regulatory enforcement, any community standard remains as helpful guidance, not professional accountability.

England and Wales show that forensic regulation with statutory enforcement can exist, though that model still does not fully answer whether DF/IR should have profession-wide practitioner regulation. As a side note and example, a medical professional in one country must meet the regulatory requirements of another country if they want to practice medicine in that other country. Not with DF/IR.

But I do think the discussion becomes more productive when we stop treating all forms of accountability as if they are the same thing. The loss of a client is not professional accountability, nor is it a regulatory enforcement.

Additional complications..

None of this means regulation automatically produces better DF/IR work. Regulated professions still have incompetence, bad judgment, bias, and dishonesty. Regulation cannot create excellence, but it can hold those accountable for incompetence, bad judgment, bias, and dishonesty. 

There are also real risks. DF/IR is not one job, and incident response, criminal forensics, eDiscovery, malware analysis, cloud investigations, mobile forensics, and expert testimony do not require identical skillsets. Much of the field’s innovation also came from practitioners working outside formal structures, not from academia, committees, or standards bodies.

One problem is that DF/IR often treats licensing, accreditation, certification, standards, SOPs, and best practices as interchangeable concepts when they are fundamentally different forms of accountability. Best practices can be useful, but they can also become an attempt by one group to impose its preferred method on the entire field without legal authority, consensus, or practical fit across all DF/IR roles.

If we confuse best-practice guidance with regulation, especially down to specific technical procedures, we may create a bigger problem than the one we are trying to solve. Medical regulation generally does not dictate how a surgeon holds a scalpel or performs every technical movement during surgery, and DF/IR regulation should not become a checklist of someone else’s preferred workflow or skills they think all should have.

Any regulatory model would have to avoid cutting out experienced practitioners who built the field through casework, research, tool development, testimony, and operational experience. Do we regulate the lab, the practitioner, the method, the testimony, or only court-facing expert work? Or all of it?

hen there is the separation between being allowed to do the work through licensing or regulation versus being court-qualified as an expert witness under knowledge, skill, experience, training, or education under expert-witness rules.

Licensing is generally consistent within a jurisdiction. Courtroom gatekeeping is not. A courtroom often only needs a “yes” to the question, “Can this person assist the trier of fact?” not “Is this person licensed by a profession-wide regulatory authority?”

Probably the most important question is this: “Do we want to keep pretending DF/IR self-regulates because a dozen entities and individuals publish unenforceable standards and practices, or do we actually want enforceable professional standards?