Investigating within the law

Economic downturns often bring more fraud to light and drive demand to uncover such activity. Unethical or disproportionate investigation practices can compound the problem, however; sometimes even tarnishing a company’s reputation more than the potential fraud itself.

By Helen Garlick, senior director of investigations, Nardello & Co

“For ‘tis sport to have the engineer hoist with his own petard”

The above well-known quote from Hamlet has its origins in sixteenth-century warfare. The petard was an explosive device. It could be highly effective but needed careful handling. The engineer responsible for deploying it faced an ever-present risk of it blowing up in his face. It’s an old metaphor, but one that continues to have force, especially when applied to the investigations industry.

In recent years, the numbers of corporate fraud and corruption cases have increased, accelerated by worldwide recession. Public awareness of the forensic-investigation industry and its practices has risen too. With this has come increased awareness of the potential for its abuse. The very public nature of several major investigations in Europe and the US serve as stark reminders of the potential damage to companies when investigators − whether independent or paid employees − either ignore the law, or use especially heavy-handed tactics in the belief that the end always justifies the means.

Unethical investigation practices are like corruption. Once accepted they become all too easily embedded in the culture of an organisation. Then, once a single case of bad practice is exposed, it becomes all but impossible to contain the consequent fall-out.

The original News International scandal in the UK might have been thought bad enough. In January 2007, a reporter and a private investigator were jailed for hacking into the mobile phones of members of the Royal Family’s staff, which is an offence under the Regulation of Investigatory Powers Act 2000 and was described by the sentencing judge as “low conduct, reprehensible in the extreme”. The editor of the newspaper resigned but the Group denied all knowledge. However, the investigator had also admitted hacking into the phones of many public figures and celebrities, including the chief executive of the Professional Footballers Association, Gordon Taylor. Mr Taylor was not satisfied by the Group’s denials of knowledge and sued. This is where it all unraveled. The plaintiff obtained orders for the defendants to produce the results of the police investigation into the earlier Palace prosecution. It swiftly became apparent that the Group had routinely employed investigators to hack into mobile phones illegally and to obtain access to confidential personal data, including social security files, bank statements and itemised phone bills. To avoid the entire story, with all damaging details, from being exposed in court, the Group was obliged to settle, paying out more than £1m.

Similarly, few cases are likely to have the same potential to dominate the headlines as that of Anthony Pellicano, the private investigator of first choice to scores of movie stars and Hollywood moguls. Pellicano has been convicted of wire tapping, witness tampering, identity theft and destruction of evidence, allegedly committed in complicity with members of the Los Angeles and Beverly Hills Police Departments. The case is a perfect demonstration of the dangers of uncritical over-reliance by clients on short-term results. The New Yorker has quoted one Hollywood lawyer explaining his use of Pellicano’s “mysterious but effective methods” by saying: “He came up with stuff that other people didn’t. He did that over and over again. He was just better.”

It must be doubtful whether clients would accept this as an excuse, as their identities and their reasons for hiring Pellicano have since become public knowledge.

The prosecution chose not to indict any of Pellicano’s clients, not necessarily due to insufficient evidence, but because, in the words of the prosecuting attorney, he chose to attack “the supply rather the demand”. However, other prosecutors are certainly prepared to target those who engage investigators to use illegal methods. The wide-ranging invasion of privacy of board members, journalists and their families by Hewlett Packard led to highly publicised indictments against the private investigators and also against the chairwoman of the company, although the case against her was later dismissed. The New York Times quoted one representative of a pension fund remarking bitterly: “The board of HP has exemplified dysfunction.”

A story currently unfolding in France, meanwhile, is a further astonishing example of the snowball effect of a single example of bad practice. In summary, after the 2006 Tour de France, the American cyclist Floyd Landis was stripped of his title after a drugs test. The French anti-doping authorities then complained that confidential material relating to the test had been stolen. Examination of laboratory computers then uncovered a Trojan horse programme that enabled outsiders to download material. The trail led to Morocco, where a computer specialist admitted having been paid by a firm of investigators. It then emerged that the specialist had also copied the hard drives of computers belonging to a former director of Greenpeace and to a lawyer who regularly acted for shareholder groups. The investigator admitted that he had collected data on Greenpeace for Electricité de France.

The company has denied all knowledge and has defended its need and right to monitor the activities of protest groups. Its security director has said: “It’s important to know, for example, if this or that group is in the radical extreme or if it is above board.” The judicial investigation is ongoing and there is no evidence of government complicity, but the publicity is acutely embarrassing.

Reputational risk

In addition to the loss of reputation and the spectre of litigation, the risk of such actions can include a damaging loss of confidence among stakeholders, including shareholders. Damage to internal morale can become significant when staff fear that they are led by a management prepared to invade their privacy without good reason.

In the past few years German corporate life has also been rocked by several corporate investigation scandals. Supermarket chain Lidl was found to have hidden cameras in stores and kept extraordinarily detailed observation notes on staff. Any legitimacy that the company might have claimed – in pursuing its rights to prevent pilfering or other misconduct – was drowned by national outcry and a sense of distaste as the press detailed the prurient level of detail amassed by the investigators.

Where similar practices are employed by a company whose reputation is its core asset, the results are crippling. The discovery of corporate spying techniques by Deutsche Telekom is best summed up with the following quote from FT Deutschland:

“Every company has the right to take action if internal information is leaking to outsiders. A public company like Telekom is in fact obliged to do this regarding any data relevant to the stock market. However, Telekom is now being accused of not only spying on its employees but also its customers, on calls made to journalists and members of the company’s supervisory board, who used the Telekom networks for their work and also for their private communications. The company now has to clarify as quickly as possible what really happened. If customer data was really abused, then Telekom will not only have legal problems. They run the risk of massive loss of confidence among customers, who up until now assumed that a phone call could be just as discrete as a private conversation in person.”

These are just a few examples of typical issues that call for advice that is experienced, ethical and proportionate. Will investigators always go to such lengths when left to their own devices? Rarely, in truth. Isolated examples of poorly judged, unethical or illegal practices are no more representative of the investigative industry as a whole than medical or legal malpractice are of those professions. Ethical and experienced investigators know that a client’s interests are best served when they conduct themselves in a way that leads neither to civil nor criminal liability (or a public relations disaster).

Whatever the circumstances, there will almost always be perfectly proper and legal means of obtaining information. Although by no means always easy, it may cost more and take a little more time, but the results are far more likely to be worthwhile, ethically defensible and, should the need arise, admissible in court.

Companies will be best served if they employ investigators who know the law, who are automatically attuned to data protection and other legal restrictions, who are used to being bound by professional codes of conduct, and who are intent upon producing effective results that also safeguard their client’s reputation.

Choosing an investigator: attributes to look for

It will always be a considerable advantage if the investigators selected by a client have recent and relevant law enforcement experience, at an appropriately senior level.

The relationship between investigators and the client’s external legal advisors must also be carefully considered, completely understood by both sides and continuously monitored. It must also be mutually respectful, however, so that the investigators are free to use their initiative.

An experienced investigative firm will never blur the line between their role and that of the client’s legal advisors, if for no other reason than the fact that maintaining legal professional privilege must always be a paramount consideration. No competent investigator, whatever their background, would venture to offer legal advice to the client, and would certainly never act deliberately contrary to the advice or instructions of the client’s lawyer.

What an investigator should be asking

Depending on the circumstances, a company should also expect a reputable investigation firm to discuss a range of issues to ensure any perceived commercial gain from intrusive or aggressive investigations is not outweighed by reputational damage. These may include:

In a case of internal fraud, how complex and how serious does the problem appear to be and what is the seniority of the personnel who are compromised? How important is it to demonstrate that the investigation was conducted at arm’s length, by independent investigators? Should regulators or law enforcement be informed immediately?
If the client needs to investigate its own employees, are there good reasons why this cannot be done openly through a formal process?
If the company is the target of rumour-mongering or other anonymous, malicious comment, is an investigation proportionate – or might it risk escalating the publicity and causing more harm?

If the company is losing confidential information, is either employee or boardroom corruption necessarily to blame? Could the problem be traced to poor internal controls and structures? One view of the Deutsche Telekom case, advanced at the time by Der Spiegel, was that different divisions within the company were effectively at war with each other. It was reported that the company had four different press offices, sometimes delivering conflicting information to journalists.

If investigations cover several jurisdictions, a country-specific risk assessment of each should also be undertaken. For example, certain types of intrusive investigation may be particularly repugnant to the public opinion of particular countries. The media reporting of recent German scandals, for example, frequently referred to the methods used as “Stasi-like”, and there is little doubt that accounts of observations and the keeping of detailed personal files raised particularly uncomfortable associations for the German public.

Forwards march

There is no reason to shy away from forensic investigators. Far from it. The converse side of Shakespeare’s petard is that, when used correctly, the weapon can change the tide of a battle. A company’s ‘handler’ should, without fail, be a trustworthy investigation firm, operating on the premise that the consequences of using irresponsible techniques will outweigh the value of any information gained. Furthermore, an effective investigation firm will almost always be able to provide the information a company needs through proper, proportionate methods – a slightly less exciting petard perhaps, but one which won’t go off in anybody’s face.

A barrister for over 30 years, Helen Garlick is the senior director of investigations at Nardello & Co and was formerly an assistant director of the UK Serious Fraud Office (SFO). She can be contacted at: hgarlick@nardelloandco.com