This is the second piece in our series about forensic investigations in the new normal. As discussed in our previous article, Planning Investigations in the New Normal, this series will address each phase of a typical investigation. This article focuses on stage two – collect and preserve evidence.
As discussed in our first article, the first phase is scope and planning, which involves asking the right questions and conducting the right research to be certain the investigation gets off to a great start. The second stage, collecting and preserving, is probably the one most impacted by the current environment of stay-at-home orders, closed offices and restricted travel. Fortunately, technological advances in the areas of video conferencing, collaboration tools, and cloud storage coupled with proper planning and some ingenuity will allow us to conduct full investigations in today’s new normal. What we learn and the investments we are making in technology will allow us to be more efficient in the future and conduct more investigations remotely when warranted due to cost considerations, or the desire to avoid travel to high risk areas across the globe.
While each investigation takes its own course, in general fraud, regulatory compliance and white-collar investigations focus on three categories of evidence: electronically stored information, paper documents and witness interviews.
Electronically Stored Information
Electronically stored information (ESI) includes all categories of data such as email, data from accounting, time keeping, operating and other systems and of course ordinary documents stored electronically. ESI is located on personal devices (phones, tablets and laptops), company servers and the increasing number of smart devices that we have all adopted in the internet of things (IoT) era. Entire books have been written on how to collect ESI in a forensically sound manner. For purposes of this article, we will focus on the challenges in the collection of ESI in the current environment.
During the planning and scoping phase, you should identify the devices and data that need to be collected. In the normal course, forensic technicians would go on-site and collect the data using the various tools they have. Of course, in today’s environment access to a company site may not be feasible. Even more complicated will be collecting data from devices of employees who are at home, either due to stay at home orders or possibly being under quarantine with a sick family member.
In the new normal, collection of ESI may be an operation of the feasible rather than the ideal. Depending on a number of factors specific to the matter at hand, you may consider:
- Having employees ship their devices directly to the forensic technologist’s laboratory (assuming the laboratory is open).
- Collecting information from servers remotely rather than going on premises.
- If you need to go onsite for collection, proper social distancing and other precautions as stipulated by local, state and federal authorities need to be considered.
There are risks in any of these approaches. Devices could be lost in transit, sources of data may be missed and if you decide to proceed with an onsite collection, there is the risk of spread of COVID-19. All of these must be carefully considered and weighed by the entire investigative team, especially legal counsel and the forensic technologists before starting the collection.
Interviewing witnesses is key to essentially all investigations. People provide facts, add context and point investigators in the right direction. Until recently, investigators generally had only two options, meeting in-person or interviewing a subject telephonically. Of course, the preference is usually for in-person interviews so that the interviewer can more easily develop rapport with the subject, read their body language and so forth. Depending on the locations of witnesses and their importance to the overall investigation, investigators often settled for telephonic interviews especially where the interview was expected to be short and focused on one or two specific matters.
The explosion of video conferencing software options in the last few years has gained wide-spread adoption over the past few weeks as many have adapted to a work from home environment. Video conferencing has many advantages over telephonic interviews. The interviewer can read the subject’s facial expressions and it is easier to develop rapport with the subject rather than holding a discussion over the phone. If you proceed with interviews using video conferencing software, there are certain considerations that you must address.
Should you record the interview? The benefits of recording an interview are obvious. It allows you to go back later and watch the interview, share it with others on the investigation team and potentially use the recording as evidence in a trial. Most video conferencing packages allow for easy recording, however that does not make recording the interview legal. Before recording an interview, the investigator should consult with legal counsel. Key factors in the legal analysis include who is on the video conference and what state and locality each person is located in. Be careful, many people have moved to second homes or to other family member’s houses, so do not assume that everyone will be at their normal “home” location. Also, if an employee is represented under a collective bargaining agreement, that may factor as to whether they can be interviewed through a video conference, whether it can be recorded and whether they are allowed (or you are required) to have a union representative present.
If you decide to interview someone in-person, here are certain considerations to help mitigate the risks:
- Follow proper social distancing and other precautions as stipulated by local, state and federal authorities.
- Disinfect the interview room and other areas prior to and after the interview.
- Limit the number of attendees.
- Avoid using hard copy documents during the interview. If you want to review documents with the interviewee, have them available electronically and either email to the interviewee in advance to view on their computer or tablet or project them onto a screen everyone can see.
Collection of Paper Documents
The third common element of evidence in fraud, financial and compliance investigations is paper documents. Although most documents are available electronically, there are inevitably times when certain paper documents need to be collected and analyzed. For example, they may contain contemporaneous handwritten notes or may not be available electronically. In the event you need to collect paper documents, consider whether any of the following are reasonable steps for your specific situation:
- Have the custodian package and send the documents via third party courier (assuming they have access to the documents).
- If you need to go on site to collect the documents, follow proper social distancing and other precautions as stipulated by local, state and federal authorities.
- If you need to go to an employee’s residence, consider guidance from the CDC and other authorities for handling and disinfecting packages.
Investigations will continue and likely increase in the new normal. While operating under the current environment is not ideal, a comprehensive investigation can be completed remotely in most circumstances. As we move forward in the new normal, we will be applying what we learn now to increase the efficiency of investigations in the future and expand the number of investigations that are done remotely even after COVID-19 is just a bad memory.
Our DHG Forensics professionals have decades of experience conducting investigations and can help you think through all these issues and more. Please consult with your DHG engagement partner or contact the author if we can be of assistance. Also check back for future knowledge share pieces that will cover the other phases of investigations.