Do's and don'ts
THE "DO's"
Do review current legislation and policy prior to commencing an investigation.
The law surrounding privacy, human rights and business practises is evolving at a fast pace. There is also a lack of case law related to these areas. It is therefore essential that the person responsible for overseeing any investigation is knowledgeable and confident in these areas.
An effective policy or employment contract will afford an investigator the greatest opportunity to conduct a lawful and effective investigation - so check these documents before an investigation commences.
Do gather the evidence in a forensic manner, as soon as possible.
If you want to use computer related evidence in formal proceedings or you wish to look at the content of a PC as part of an investigation - gather the evidence in a forensic manner. This will ensure that the evidence is admissible and the integrity of the investigation is maintained. If you do not have the correct forensic tools AND a qualified person to use them, seek advice.
Do think "admissibility" - record your actions and reasons in an appropriate manner.
Any person or any action associated with an investigation may have a bearing on that investigation and in particular the fairness of the enquiry. All actions, decisions and results should be recorded properly.
Record your actions clearly and whilst they are fresh in your mind. Don't just record what has happened but also why that action was taken. At all times consider what you would say if a court asked you to explain and justify yourself - what record would you refer to months after the event? Write it down and expect to be scrutinised.
Do act impartially and fairly towards the suspect
Despite your suspicions and personal feelings you must always act in an impartial and fair way when conducting an investigation. Satisfy yourself that actual grounds exist to support your suspicions. Can you evidence these grounds? Why are you taking this action? Is the suspected wrongdoing and anticipated results proportionate to your intended actions, which will form the investigation? For example, do not covertly monitor a member of staff if you are trying to establish that they have committed a minor breach of company policy.
"THE DON'TS"
Don't confront the suspect until you consider covert options
Covert investigations are not only lawful when conducted properly but they afford the investigator the greatest opportunity to gather irrefutable evidence. When considering such action, ask yourself if the investigation warrants such an intrusion of privacy. Is the matter serious enough and is covert monitoring likely to lead to further, relevant evidence?
Always consult with a legal expert prior to commencing a covert investigation.
Don't tell anyone about the investigation unless absolutely necessary
No matter how well you know someone, a friend or colleague, do not inform them about the investigation unless they need to know. Despite the assertions that they will keep the "secret", investigations are hot news and the person is likely to tell another, who will also keep the secret of course!
Do you know how many, or who else might be involved in the investigation?
At the beginning, the answer is likely to be "no" - so do not talk about it. If you are in doubt about who to report something to, go directly to the boss!
Don't interfere with the suspect's personal computer
If you believe that evidence is held on a computer, do not be tempted to look for yourself. Gather the information through forensic analysis if necessary. The suspect need never know and if you do find pertinent evidence, it will be admissible and an allegation that you "planted" or amended the evidence is unlikely to be made.
Don't gather computer evidence unless you have forensic tools
Forensic analysis involves an appropriately trained individual, using forensic tools to obtain a copy of the suspect computer hard drive, in such a way that the hard drive is not altered and nothing is changed. This process will allow the information that is gathered to become admissible evidence if necessary.
|
Home