Internal theft and diversion of inventory

The changes to economic conditions are having a negative affect on some employees honesty and integrity. Cases of embezzlement, internal fraud, theft, and money laundering are on the rise. A wide range of employees from entry level to executives are discovered taking advantage of companies. One recent case found that a sales executive making $280,000 was stealing $700 per month from their employer. This was a 8 year veteran of the firm.

Whether a company suspects some fraud and wants to find it, or if they want to review their internal procedures to prevent it from happening in the first place, a professional investigative agency can help secure the hard earned profits of a company. After having seem a multitude of employee fraud, an investigator can pinpoint to weak points in a companies operations based on where theft and embezzlement typically occurs. It may be a vulnerability in physical security, such as an unsecured door bear the parking lot and near unlocked merchandise. It may be employee access to sensitive customer info such as social security numbers. It might be a process for handling payables which allows an employee to set up ghost vendors to diver funds.

A combination of analyzing procedures, and even subtle and covert observation of employees discovers ongoing theft, or even prevent theft about to happen. Once informed, the client firm can handle it however they want. Some prefer to dispose of the situation privately depending upon the circumstances. Proper documentation of the scheme allows minimizing the loss, and also making it likely that recovery of some assets is probable. By discovering the fraud and tracking the location of funds or assets before confronting the fraudster, it may be possible to use legal and other techniques to freeze and seize the illegally taken companies property.

Many employees are capable of dishonesty depending upon their life circumstances. Professional advisors such as accountants, bookkeepers, attorneys, and consultants are prone to this as well. Covert investigations can reveal the potential or actual damages before they permanently harm a company.

Why not do my own investigation?

On the surface many of the activities involved with an investigation appear to be understandable, and a client might be tempted to perform a “DIY Investigation.” Following a subject, looking up background information, and asking questions of 3rd parties is not that hard. However, there are pitfalls for the unlicensed citizen in doing their own investigation.

Legality – A licensed private investigator needs to be aware of the constantly changing laws governing the activities on a case. Video recording, pretexting, surveillance, and interviews each have state and Federal laws which restrict how these can be performed. If a person does something the wrong way, the results of their investigation can be voided, and they may even be liable for civil damages and criminal prosecution. For example, pretexting is the process of making up a scenario in order to gather information. Calling a business pretending to be the relative of an employee to see if they came to work that day, for example. Some types of pretexting is legal, some is not. Pretexting to get basic information is usually legal, pretexting to get personal or financial information is not. We are working on a case now where an investigator allegedly used a pretext to attempt in obtaining the bank account number and balance of a subject.
Surveillance has to be done correctly. There is a fine line between surveillance and stalking. A private citizen doing surveillance can easily be perceived as stalking or intimidating the subject being followed. A licensed investigator, working on a valid case knows how to properly observe a subject without crossing the line. Surveillance should be done covertly. If the subject catches the person following them easily, the claim could be made that the discovery was intentional in order to scare the subject. Investigators are 3rd parties without personal involvement in the case, taking the emotional factor out of it.
Something as simple as video recording can get an ordinary citizen in hot water. In most states recording of a conversation requires the permission of both parties. When video recording a person, the camera will normally have a microphone catching sound. Even if the subject is far away, the voices can be picked up. This can technically be construed as illegal eavesdropping. Courts have determined that even deleting the audio is not good enough, because recording it in the first place was the crime. Many private investigators disassemble their $1000 video cameras to defeat the microphone recording capability for this reason.

Licensure – Most of the activities thought to be part of an investigation are licensed activities meaning that anyone who performs them must be licensed. Taking part in this without a license is a crime by itself. Even if the non-licensed investigator is not found out, if any of the information is ever used in court, or used to decide to bring a case to court, the opposing attorney may ask how the information was developed. If it turns out that an amateur unlicensed investigation was done, it can result in the case being thrown out of court, and the plaintiff responsible for the legal fees of the opposing side.

Techniques – Even though some of the investigative activities seem easy to understand, subtle techniques go into making them successful. Years of experience and training o into learning how to gather information, document it properly, and analyze it for maximum results. More importantly, when the case is complete the results are legally usable in court if needed. The investigator is a qualified witness with no bias or ulterior motive. A direct party to a controversy who did their own investigation will have the credibility of their reports questioned.

Data access – A licensed professional investigator has access to private secure databases that a citizen is not allowed to get at. The investigator knows how and when they can use this information legally on a case.

Professional network – On most cases there will be some aspect that a specialist in an area of expertise will come in handy. A fraud investigation might get a head start if a computer forensics examiner can answer a few questions. A professional investigator has dozens of colleagues with different expertise and experience to call on during case. A well developed network works together so each person helps the other out when needed. Local groups or investigator associations are put together for this purpose. This is like getting an entire team of experts for no additional cost since most of this internal consultation is not charged between the members.

The answer to the question you are looking for in an investigation is probably an important issue in your life or business. Doing it yourself to save some money almost always defeats the purpose of why the answer is valuable to you. Think about your own profession and consider how it probably does not make sense for a person to try and do for themself the service or product you provide.

Analysis may be the most valuable investigative skill

Judgment and analysis are where investigators add real value for a client. An average investigator can observe a subject, retrieve information, or lookup data from records providers. Providing the highest level of intelligence to a client comes from deliberate attention to the information gathered, and then extracting valuable intelligence from it. Gathering the information is just the beginning. Finding a single suspicious transaction on a bank statement is still part of gathering evidence. Observing a target visiting a bad location is just obtaining information. Learning a fact from a witness interview is still just gathering data.

When the investigator looks at data points which do not seem like red flags on the surface, and creates a pattern of activity or combines them into proof, that is analysis. Good investigators know that a case often turns on something which is apparently innocent on the surface. A $20 charge at a marina might seem like nothing. But to an investigator working a divorce case it might be a date with a mistress. To an asset recovery specialist it could be a lead to yacht ownership under a different name. For the fraud investigator it might lead to a location where a meeting took place.

Fortunately most cases have reasonably simple solutions with consistent effort. Cracking open the really hard ones comes from finding the signs to the answer within complex or tedious information. I recall reading about the case of a violent assault in Miami where the investigator Ken Brennan watched hundreds of hours of surveillance camera video. After weeks of tedious observation, he noticed one frame where the attacker took just slightly more effort moving a suitcase out of an elevator. That was the key to discovering the identity of the perpetrator, when dozens of other investigators had come up empty.

Being observant comes with the problem of data overload. If you see everything, and import all the data, it makes it harder to pay close attention to any one particular item. This is where technology can help. Organizing information into a matrix is the first step. Whether a high end database, or by tweaking an Excel spreadsheet, putting the volume of data into a visible format serves two purposes. First it makes it easier to see patterns. Second, it keeps the investigator from being hesitant to catch more data due to being overwhelmed. Having hundreds of names, addresses, phone numbers and locations is worthless if it cannot be used. Having so many data points that even a single extra one can’t be collected runs the risk of missing out on that one more fact that could be the answer.

So catch everything, load it up in a some organized way, and then use the analytic skills to make into something valuable. For almost 20 years we have run a company which performs real estate records research, such as document forensics and title searching. We have noticed that in the volumes of recorded deeds, mortgages, liens, and other documents, a gold mine of information is often not used. A traditional title search might catch the names of buyer and seller, and the sale amount from a deed. But what about the name of the title company, the notary who verified the signature, or the two witnesses who signed off on the event? What if the same person witnesses a mortgage in 2001, and then again in 2006? That person has some relationship to the target, and has knowledge of their financial dealings. These could be valuable contacts in an investigation. What about a mortgage trend for an individual? Instead of looking at a single transaction, collect all the mortgages, refinances, secondary properties, releases, and payoffs from the land records for the individual for a period of time. Using a spreadsheet, you can see what the mortgage balances and equity was collectively, and how it went up and down over time. The fact that a persons total debts went from $400,000 one year to $800,000 the next could be telling. The fact that he or she suddenly went from $100,000 equity in properties to over $500,000 needs attention. Looking at a single transaction might not reveal this.

This same process can be applied to any facet of investigation. Surveillance notes, interview records, database lookups, or bank account records can be taken to a higher level with analysis. On a surveillance, do you catalog every vehicle license plate which drives by with date and time? You would have no legitimate purpose to run the plates, but what if the same car was found to be operating near multiple locations for a subject, such as their home, business, and kids soccer game. Depending upon the nature of your case, this could create an allowable DPPA use.

Analyze everything obsessively even though much of the time it turns out nothing. As we all know there is no magic bullet to an investigation normally. We can however create those situations which do make you appear to be a wizard to your client by catching the break on a case that is not random, but because of your deeply developed analysis skills.

At the highest levels of investigation, analysis is the key component. Expert surveillance, database lookups, or even financial research are not the areas most highly valued at large investigative firms or high level government agencies. The analysts are the heroes. The good news is any agency owner can incorporate this expertise into their business by becoming one themself.

Top 10 often overlooked sources for hidden electronic evidence

It is standard procedure for investigators in both the public and private sectors to extract intel from electronic records in addition to obtaining physical evidence. Subpoena and discovery criteria almost always include access to electronically stored information (ESI) as part of the language in the order. Since ESI is a relatively new field of evidentiary procedure, the wording on many default discovery orders does not specifically limit the scope for collection of data. This creates an both an opportunity and an obstacle for the attorney which a skillful investigator can assist with. The usual starting points for ESI collection are corporate file servers, email messages, word documents, spreadsheets, and web viewing histories. Depending upon the nature of the case there may be other data specific to the circumstances.

Beyond these, investigators can provide added value to clients by having a checklist of often overlooked places where valuable ESI and intelligence can hide. For starters, here are some examples of locations to observe for additional information.

1. Other Facebook messages – Of course Facebook and other social networks are near the top of the list for investigators, but there are always enhanced techniques for obtaining information in these venues. These tricks will change over time as the social networks change and users adapt. One current example is Facebook’s “Other Messages” section. A submenu of “Messages” the “Other” folder contains messages from users not currently connected with the user. Often these messages are from distant acquaintances looking to communicate without friending the user, or from marketers. Certainly keep researching methods to get more from social networks than a typical investigative professional.

2. Voicemail message audio files – In many corporate and alternate phone system environments, voicemail messages are saved as audio files on a server or local machine. When this is the case, these files are subject to the same storage / backup / retrieval methods as any other computer file. Frequently the system even retains deleted voicemails for some period of time, often months. Even if the phone system retains voicemail files for a few days, any automated backup will catch this file and have it on an archive disk or tape for retrieval. Imagine the investigative value from voicemail messages that the subject thought were deleted.
3. Box/Google Docs/Evernote – Many individuals are using third party file hosts for various purposes. Oven time systems such as Box.com, Evernote, and Google Docs are more flexible than in house applications so that users can configure them as customized to-do lists, calendars, and worksheets. In extreme cases users apply these resources to intentionally keep information off the corporate server or their own personal machine for security purposes. The files and notations in these files can enhance official records or add context to previously obtained information.
4. In game messaging – Facebook messages, Tweets, emails, and text messages are obvious source of communications history for a subject. There are additional places a cautious subject may exchange more sensitive information. Many games such as World of Warcraft have in-game messaging utilities where users can communicate while playing. Even the popular Words With Friends game has a chat dialog. In many cases a subject may be less guarded in communicating in these environments as the forum is considered less obvious, and the other party more of a close acquaintance.
5. Discussion forums – Once seen as obscure venues for techie types, online discussion forums have exploded into popular arenas for discussion between like minded individuals. The common themse may be based on a certain industry, a hobby, recreation, political interests, or social pursuit. The participants normally go by user names rather than true names, but often this is the prefix of their email address or some variant. If the investigator already has access to a targets computer, the browsing history files will have record of the sites visited. A search of received emails will also reveal signups to various online forums. Because the user perceives their posts as anonymous, they are often more frank  with their thoughts and comments. The messages can demonstrate opinions different than official testimony or evidence.
6. Meta data – Of course, no discussion of hidden ESI would be complete without covering meta data. This information is stored within a disclosed file, but not part of the visible record. For example a Word document might have meta data describing which user(s) collaborated on the file, the dates of revisions, and even retained records of what has been deleted.  Meta data on pictures can reveal the date and time of the picture, GPS coordinates, and the serial number of the camera. Since meta data covers a large variety of information, investigators can look for it almost anywhere. A PDF file might have website addresses where it was posted, a spreadsheet could contain hidden bank account numbers, and voicemail files often collect the caller ID of the incoming line.
7. Notes in margins of scanned PDF’s  – There are two types of PDF files, one created by document conversion and another by scanning. A converted document is created when a user takes a Word, doc, Excel spreadsheet, or other editable file and converts it to an Adobe PDF file. These often retain the readable and searchable text within the file. A scanned PDF is essentially a picture of a paper document. The text is not “readable” by a computer only by human eyes. Cut and paste is not possible, for example. An advantage for scanned PDF’s is that since they were once a hard copy document, notations may have been added. Look for fax header lines, written notes, or time stamps in the margins. A scanned PDF can also be compared to an original to ensure it is the same version, and discover what changes have been made. Even smudges on one version can tell when it was scanned compared to another version. We worked on a case where a scanned PDF had a faint coffee mug stain which was matched to a cup controlled by a particular office employee.
8. Outlook calendars – Be aware that some subjects will keep more than one calendaring system. A business version on Outlook using the corporate server, and possibly others on PC’s or Google Calendar. Look for similarities between the two, and emails where an event was added by a third party. Conference calls and webinars are particularly common for third party additions. A conference call can be useful to establish that there was a conversation on a particular date and subject. These often use a phone network dial-in that will not alwasy show in phone logs.
9. Email counter party records – When analyzing email messages, look for unmatched conversation chains. If a conversation appears one-sided or is missing contextual messages, it may be because the user has other accounts which were used intermittently, or that some messages were permanently deleted. The counter party to important email threads may be able to provide the missing information and location of other email accounts. The same is true for attached files. Look for file names in emails which do not appear in the computers file systems. If these were deleted, the counter party would have a copy if needed.
10. Shopping / Fedex account records – Instead of disregarding shopping records which appear to be personal purchases, take a look at email confirmations of online shopping. The record may reveal alternate email addresses, physical mailing addresses,or credit card accounts not previously known. If the item was sent to a third party it may have been a gift for an acquaintance or associate who may be a lead. Fedex, UPS, and shopping site account histories are maintained for a long time, and can reveal events from years past which could be valuable. Did the subject ship an item from an alternate location? Was there a type of item purchased which needs investigation such as a part for a vessel, firearm, or romantic gifts?

Bonus: GPS devices – While more location assistance is coming from smartphones, many individuals still use stand-alone GPS devices such as a Garmin for day-to-day navigation. Many of these devices use a “bread crumbs” method for tracking past movements. An investigator may be able to extract the prior activities by looking at the trail of navigation from a  vehicle GPS device. Scrolling through the entered addresses in the log file can also reveal what locations a subject was looking for on a certain day. The inclusion or exclusion of certain addresses also shows which places a subject does not know how to get to, and which ones they know with familiarity.

Operational tip: When analyzing an Excel spreadsheet, look for “static cells” which should be formulas. For example, if a commission amount should be calculated by multiplying a sales figure times a certain percentage, be sure that the cell contains a formula and not a fixed amount. This will not be readily apparent by looking at the sheet. One way to discover this is by making a few copies of a spreadsheet and changing various figures on the sheet, and seeing which numbers don’t change, or which ones result in “Error” messages.

Facebook is voluntary surveillance and depositions

The hot subject in investigations is using social media such as Facebook or LinkedIn for information on a target. There are numerous methods for searching and using information from online forums. Before figuring out how to get the information, an investigator should look at the reality of what Facebook is, and how valuable it could be.

A Facebook account in effect is the target doing surveillance on them self. They take their own pictures, record their own video, and document their own opinions and conversations and put it in a central location. Making it more valuable is the fact that the target is recording the most candid segments of their life. Where in a formal witness interview they will be guarded and careful about what they say, on Facebook the tendency is to be less inhibited.

As careful as a person might intend to be, Facebook is a seductive forum. The validation factor is hard to resist. Posting pictures, jokes, stories, or comments that are dramatic or interesting gets the most “Likes” and fuels the ego of the account holder. Unlike email where there is only one recipient, Facebook begs the user to let their hair down in the most extreme way. In addition, the accumulated history of posts and photos paints a picture of the personality of the person and how it may have changed over time.

While Facebook has fewer hard facts than discovery from other sources, it is the most valuable resource for truly understanding what is going on in the life of the person. An investigator with true analytic skills can turn superficial ramblings into deep intelligence.