Investigation Planning and Scope Review in the New Normal

Additional thought and extensive brainstorming is required at the planning stage to scope in the intricacies brought by a remote working setup. The investigators need to assess the availability of and access to data and people in advance. Often, getting time slots for interviews of senior level people can pose a challenge.

The success of an investigation may hinge on the support received from senior management and the cooperation of the relevant teams.

The traditional scope needs to be broadened to combat the real-time challenges encountered in planning and executing an investigation in such a set-up. A comprehensive understanding of the organisation’s IT structure, including the operating systems, nature of devices used and their encryption system, BYOD policy, local IT support teams, need for technical expertise, availability of enabling technologies for conducting E-discovery procedures online, high-speed internet, adequate capacity to upload back-up/ imaging data and data privacy policies, is quintessential.

Tapping the right sources for information

As mentioned above, remote working set-ups have increased the number of active users on messaging applications. While communicating through an email there is a stream of consciousness and coherence which is generally not found in chat applications. The data back-up from these applications can greatly help the investigator to define the true intent of the suspect and timelines of fraudulent activities or building context to past events.

Microsoft, in its recent “Remote work trend report: meetings”4 stated “We’ve seen a new daily record of 2.7 billion meeting minutes in one day, a 200 percent increase from 900 million on March 16”. For an investigator considering the volumes of data generated through these channels are critical while conducting investigations in a remote environment.

This might necessitate scaling up existing technology to accommodate newer data generated on these platforms or homogenize the data collected before running further analysis with traditional tools. Depending on the volume of data to be analyzed using AI/ML tools is critical. Either way, the investigator needs to have a comprehensive understanding of the number of channels used in any organization. This will help in assessing where relevant information resides on company servers, and how it can be extracted from the cloud such that no data source is left untapped.

Enabling Technology

Collecting data regarding “who knew what and when” may appear to be straightforward but it is quite the opposite. Access to equipment necessary for collating and reviewing data might be challenging due to remote working (and state imposed lockdowns during COVID-19). Not all systems can be backed up through online modes – necessitating the cooperation of local IT staff.

Special technologies and skill sets are required to conduct
E-Discovery procedures online. A key challenge is the access to uninterrupted high-speed internet and imaging software which can conduct online imaging. In addition, maintaining the sanctity of data and chain of custody throughout the process of imaging needs careful consideration.

Conducting Interviews

A critical aspect of interviews is the way questions are framed. While the queries have not changed per se, social distancing requirements have made face-to-face interactions nearly impossible and introduced new media for conducting interviews. One of the biggest limitations of investigating in a remote environment is that there is no physical control on the environment of the interviewee/ potential fraudster. Suspects can be in their comfort zones – the interviewers cannot have physical control over the set-up for interrogations to avoid distractions. Even worse, the presence of unconnected people cannot be detected and many times cannot be avoided. If a suspect is being guided or prompted by any other person sharing the same room there are limited measures an interviewer can take to get satisfactory response. The inability to make unannounced visits also reduces the efficacy of interviews.

Ensuring a secure communication line and that no one is recording the interview without authorization is yet another challenge.Most online video calling platforms will inform the participants if the meeting is being recorded, but participants can record the interview discreetly.

Before starting the interview, the investigators should clearly lay down the rules for interviews – camera to stay on or off, recording allowed or not etc. to keep the interview on track.

There is also the question of body language analysis. Kinesics often provide useful hints into what’s going on in the mind of the interviewees which interviewers can use to draw inferences as to what is being said in the interview and to increase or decrease pressure on the interviewee. Remote interviews pose limitations on analysis of body language and hence the investigators may miss out cues to modify their line of questioning.

Information collected in an interview is of paramount importance in any investigation and thus, safe storage and custody ofinterview recordings is very crucial. The legal provisions and company’s policies for recording such meetings needs careful evaluation.

However, conducting interviews in a remote environment can also promote secrecy of the investigation process. If there are multiple interviewees, they can be unaware of the fact as to who else is being interviewed and in what order. This can deter the suspect from sabotaging the information that will be shared by other interviewees.

Data laws and Jurisdiction

Ensuring adequate controls over data is taxing when organizations
are spread across the globe and have thousands of employees. While conducting remote investigations, there can be less than ideal physical control over the custodian’s device. In case where the custodian’s workstation is remotely connected for desktop imaging and the custodian is unwilling to share the information, there are numerous ways for the custodian to interfere with the imaging. Thus, the investigator needs to consider security measures that need to be taken for preventing unauthorised and deliberate destruction of information.

Remote investigations can span across countries and hence data protection laws of other jurisdictions too will have to be considered. For e.g., European Union’s (EU) General Data Protection Regulation (GDPR) addresses data minimisation, restrictions on personal data collection, and instructions to organisations for not collecting personal data, unless necessary.
It is important to note that the GDPR also applies to organisations that are not based in the EU if they collect or process the personal data of any person located in the EU. It lays down provisions for sending a notice and obtaining consent from the individual whose personal information is being collected.

Further the regulation specifies rules about data portability and safe record keeping. The investigator must keep in mind what is expected of them by the government regulators and the legalities behind collecting personal data from devices of the custodian.