How far do you take...
 
Notifications
Clear all

How far do you take it corporate investigators?

11 Posts
8 Users
0 Likes
542 Views
jblakley
(@jblakley)
Posts: 110
Estimable Member
Topic starter
 

How far do you normally take investigations in your environment before you call authorities? Do you normally contact them after an initial quick look, or do you do a full investigation before calling them? This is just a curiosity question…

 
Posted : 09/02/2017 3:43 am
UnallocatedClusters
(@unallocatedclusters)
Posts: 577
Honorable Member
 

jblakely -

You pose an interesting question, but I am wondering if you could provide a bit more detail.

For example, I have been taught that if I find contraband on a phone or computer, I should absolutely NOT continue my investigation by continuing to look for additional evidence, but rather I must stop my analysis activities immediately after finding just one piece of evidence and contact the authorities right away.

If I find evidence of other types of potentially illegal activities such as embezzlement/misappropriation of funds or theft of trade secrets, I will continue my analysis until I believe I can provide reasonably complete evidence that such activities did in fact take place.

I will then provide my findings to in-house counsel, who will invariably contact outside counsel to discuss next potential steps, such as termination of a current employee or the filing of a temporary restraining order or other complaint against a former employee.

For the latter types of situations, I make sure my forensic ducks are in a row, so to speak backed up with rock solid evidence, and then I let the attorneys determine their legal strategy and if they wish me to perform additional analysis.

 
Posted : 09/02/2017 5:16 am
jblakley
(@jblakley)
Posts: 110
Estimable Member
Topic starter
 

Thanks for the reply!

Let's say that something is in scope, and you're investigation stays well within that. Do you bring legal in at the very beginning of every investigation you do, or do you wait until you have the facts as complete as possible before letting them know that you have a situation they may need to get involved in? Sometimes we may need to investigate an incident that may not really be an incident, so I don't see a need to involve legal if you're not entirely sure if there's been an incident without gathering all of the facts first - maybe I'm way off about that…

 
Posted : 09/02/2017 5:52 am
UnallocatedClusters
(@unallocatedclusters)
Posts: 577
Honorable Member
 

I always recommend involving in house legal counsel.

 
Posted : 09/02/2017 5:59 am
Adam10541
(@adam10541)
Posts: 550
Honorable Member
 

When you say 'legal' do you mean lawyers or the Police?

I'm ex LEO and if I see anything illegal related to child exploitation or the like then the rule here is stop immediately, make sure you have copious notes of exactly what you did, then contact Police to hand over the evidence.

Out clients are aware we will take this approach if we see something of that nature.

As for other illegal activity such as evidence of fraud, embezzlement etc, I will finish my analysis and put together a report with my recommendations to involve Police.

With lawyers I'll generally get them involved from the word go where ever possible as this will allow us to scope our investigation more accurately.

 
Posted : 09/02/2017 7:18 am
MDCR
 MDCR
(@mdcr)
Posts: 376
Reputable Member
 

If there was a crime that was committed outside the boundaries of our own legal paragraphs, then we'd call law enforcement. Only standing indubitable exception was CP, fortunately i never ran into that.

If ii end up doing forensics for a corporate entity, i'd have police on speeddial.

 
Posted : 09/02/2017 8:36 am
(@c-r-s)
Posts: 170
Estimable Member
 

Do you normally contact them after an initial quick look, or do you do a full investigation before calling them?

The latter one, if at all. The default for most companies is not to get in touch with LE under any circumstance. There are many good reasons for this (public exposure, regulatory consequences of the incident, losing leverage on the suspect, interference of outside investigations with business activities etc.), but there are two to act differently
1. You are legally obliged to bring your findings to the attention of the authorities. This is hardly ever the case in constitutional democracies (like in Section 138 German Criminal Code).
2. You are planning legal action against somebody, which would bring in LE anyway.

Both situations and their careful assessment require the inhouse investigation to be completed.

 
Posted : 09/02/2017 6:42 pm
jblakley
(@jblakley)
Posts: 110
Estimable Member
Topic starter
 

Wow…thank you for the responses everyone! I'm looking at potentially putting this into policy for us to follow. I realize that we may have to veer from policy depending on the situation and no 'one size fits all'.

 
Posted : 09/02/2017 7:45 pm
pbobby
(@pbobby)
Posts: 239
Estimable Member
 

To concur with all the comments given.

The forensic analyst is rarely the decision maker you need a chain of authority that includes legal and management.

Typically it's only CP that we have an established if-you-see-it-stop-and-tell policy. But it's hard to write a catch-all policy; much easier to focus on obvious situations such as finding CP. For example, I see an employee writing a suicide letter in Microsoft Word… you bet I'll contact someone immediately… etc, but we're not going to write a policy on that.

Analysts don't operate in a vacuum in a corporate environment fortunately.

 
Posted : 09/02/2017 8:43 pm
(@armresl)
Posts: 1011
Noble Member
 

It's not a policy if you "veer"

You will find yourself in more trouble "veering" from a policy than if you never had one in place, because veer indicates someone had to make a decision to overwrite that policy.

Wow…thank you for the responses everyone! I'm looking at potentially putting this into policy for us to follow. I realize that we may have to veer from policy depending on the situation and no 'one size fits all'.

 
Posted : 09/02/2017 9:19 pm
Page 1 / 2
Share: