“Watching the Corporate Detectives”

Management and Oversight of Internal Investigations Conducted by Private Corporations

Abstract 

The UK Post Office-Horizon scandal highlights the issue of how a corporation can easily run roughshod over employee rights when it comes down to the conduct of investigations whereby an employee, or in the case of the Post Office Limited, a SubPostmaster, is the subject of an investigation following an allegation, incident or even a speculative investigation (known as a ‘fishing expedition’). 

With regard to UK’s Post Office-Horizon IT scandal, had the Post Office not been privatized by the Conservative Government via the the Postal Services Act of 2011, it would have remained subject to the laws applicable to investigative practices conducted by publicly owned companies (known as ‘Public Bodies’) and, most of Post Office Ltd.’s evidence would have been deemed inadmissible and unlawful. 

Without these legal protections, management, lawyers and investigators worked in cahoots to protect the Post Office’s reputation, maximize its profits and advance individual agendas including conducting flawed investigations and launching malicious prosecutions against innocent employees. The outcome led to the destruction of livelihoods for SubPostmasters, loss of life and years lost as the victim’s bravely fought for justice facing up against a giant of a corporation and former British establishment body with seemingly unlimited resources.

The deplorable conduct of Post Office’s executive management and corporate lawyers during the ongoing public enquiry speaks volumes about the lack of accountability still today and the complex avoidance structures and instruments in place to protect these powerful corporations. Not one of these executives have been held accountable at time of writing this paper. The public inquiry continues. 

This paper makes the case for bringing these powerful corporations and their investigative processes in line with the established laws applied to investigations conducted by Public Bodies. It calls for greater oversight, transparency and independent oversight of corporate investigations. Finally, it highlights how profit, self-interests and performance can work against natural justice and why the investigative system is riddled with bias and errors resulting in it being inherently working against the individual employee. 

Post Office-Horizon IT scandal

The Post Office and Horizon software scandal has been described as one of the most widespread miscarriages of justice in British history. Between 1999 and 2015, over 900 subpostmasters were convicted of theft, fraud and false accounting based on faulty Horizon data, with about 700 of these prosecutions carried out by the Post Office. An interesting nuance here is that prior to 2013 the Post Office including their investigations department (‘Post Office Investigations’) used to be in Public ownership (a nationalized company) and therefore classified as a ‘Public Body’ and subject to the requirements of a wide range of human rights-oriented legislation including the UK’s Regulation of Investigatory Powers Act of 200 (RIPA) which we will discuss in more details later.  

Between 1999 and 2015, the Post Office and the statutory authorities of the UK, including the Crown Prosecution Service (CPS), prosecuted hundreds of subpostmasters in criminal prosecutions in magistrates' courts and the Crown Court when the Horizon IT accounting system showed money was missing from their post offices.

The conduct of investigators within corporations (as opposed to regulated Public Bodies) is supposedly, albeit informally, governed by various, non-specific laws and regulations that help outline the legal framework for investigators and associated parties to use during the conduct of investigations, evidence gathering, and surveillance activities. Internal policies should also lay out the principles and practices to ensure that investigations are proportionate, fair, impartial and specific. 

However, adherence is neither adequately supervised, audited or independently verified. Corporations run circles around Works Councils and Trade Unions have almost disappeared from the modern workplace vernacular. There are no documented cases in which a company has been prosecuted for overreach or misconduct during investigations. In other words, no one is looking at how these companies behave, there is no mandatory  independent party looking after an employee’s interests and there are no consequences for overzealous or incompetent investigations. 

It is worth for a moment to consider the strategy of the corporation. At the outset of an investigation, it will likely seek to reach a conclusion swiftly and will want to pursue only the investigative lines of enquiry that delivers a swift outcome and with a view to prove a predefined ‘working hypothesis’ typically built around the initial information or complaint. Working hypothesis leads to a common bias that professional investigators strive to recognise and avoid. Working hypotheses (a category of ‘investigative bias’)are highly loaded and prejudicial to the subject under investigation. 

During the recent investigation in the UK into the disappearance of Nicola Bulley, repeated reference was made to the investigator’s’ ‘current working hypothesis’. It is critical to understand the impact that hypothesis generation can have upon the outcome of an investigation. Investigators acting in a ‘blinkered’ manner risk missing evidential collection opportunities. They omit lines of enquiry or lack an understanding what a ‘reasonable and necessary line of enquiry’ is, they demonstrate poor judgment and decision making. In this situation, investigators look to confirm their initial ideas (hypothesis) and downplay conflicting information, or investigators not identifying all plausible alternatives before they start collecting, evaluating and integrating information to arrive at a decision. Changing these behaviors, and developing what is called, the ‘investigative mindset’ is essential.

Lawyers and Investigations 

Non-specialized Lawyers conducting or leading investigations is a bad idea. Typically, lawyers are not practically trained in investigative techniques to the same standard of a seasoned investigator, for example from a professional frontline organization such as the Police service. They will certainly be less experienced in identifying and pursuing investigative channels and not used to working within the limitations of the law applicable to evidence gathering. The same applies to untrained and inexperienced  employees in HR and Employment Relations. Given the stakes for the employee in question, this is worrying. 

It is important to recognize that individuals responsible for conducting investigations within a company may be driven by career aspirations, which often translate into financial motivations to achieve specific "results." Their performance is evaluated by management and the executive team, with an expectation that outcomes align positively with the corporation's interests. As a result, these findings significantly influence the individual investigator's annual performance reviews.

Laws Covering Investigative Practices

In large corporations,  investigations are typically carried out by an individual or team sitting in the legal or compliance function and typically involve the HR, security and the legal department. 

Whereas Public Bodies are legally obligated to adhere to investigative rules and practices which align to, amongst other things, human rights, individual legal protections, investigative proportionality, privacy laws and other due process as it pertains to evidence gathering, interviewing, digital surveillance, legal representation for suspected individuals and so on, Corporations have no mandatory investigative legal boundaries or any obligations regarding transparency. 

Corporations are not held to the same rigor and oversight as public bodies. Furthermore and in reality, anyone can become an in-house, corporate “investigator” whereby in many jurisdictions, this is a licenced activity requiring proof of competency and experience. 

The recent Post Office Horizon scandal in the UK shows us what can happen when commercial and reputational interest overrides objectivity,  fairness, impartiality and objectivity. Employees, who may be subject to malicious allegations or otherwise should know their rights and be prepared to exercise them. It might just save them from investigators who are least qualified to adjudicate a case. It is crucial for investigators within corporations to be aware of and comply with the relevant legal framework governing their behavior to ensure that investigations are conducted lawfully, ethically, and in line with the rights of individuals involved. Equivalency to Public Body rules pertaining to the conduct of investigations is not only necessary, it’s the right thing to do. Also Corporations should ensure that investigations are managed by well-trained individuals who have a robust appreciation and working understanding of the appropriate methods, relevant laws but hold themselves accountable to the highest ethical and moral standards. 

Example - The UK’s Regulation of Investigatory Powers Act 2000 

While a serving police officer in the UK (the Police being a designated UK Public Body), I welcomed the enactment of the Regulation of Investigatory Powers Act 2000 (RIP Act, or RIPA). RIPA ensured that the investigative and any associated surveillance activities by Law Enforcement (the Police, Customs & Excise and other Public Bodies) were properly regulated in time for when the Human Rights Act 1998 came into force in October of 2000. RIPA had many benefits but one of the best was requiring Police and other public bodies to be thoughtful and diligent in their investigations and to use intrusive techniques (e.g. (surveillance) selectively and after having exhausted other, less intrusive, investigative techniques. RIPA also helped manage-down unconscious, investigative bias and example of which is assuming someone with a criminal record for burglary, will likely be continuing to burgle and therefore arbitrarily put under physical surveillance or subject of a speculative search warrant. One basic prerequisite is that RIPA requires reasonable grounds (to suspect a serious offense was going to be committed). 

Put simply, what I liked best about RIPA and other similar rules is that it forced investigating officers to act objectively, proportionally, thoroughly and with a high degree of professionalism. Above all though, it demanded transparency and accountability which is a good thing.

By way of an example of objectivity, let’s  say information was received from a credible informant that says that ‘Jack’ is going to commit an aggravated burglary next Tuesday night. We also know from CCTV that Jack bought a pair of gloves, a knife and a crowbar from the local hardware store and he’s been noticed reconnoitering the house mentioned by the informant  and he has a long record of committing violent, nighttime burglaries. 

Within the law, the facts presented together should be enough to authorize some time-bound surveillance so the investigating officer would present the circumstances and ask for authorisation first from a Senior Officer or a Magistrate before putting Jack under physical surveillance on that date. In this case, the Police are being “fair” to citizens by potentially protecting them from a serious crime, and fair to Jack by acting methodically and proportionally. Seems like a good thing right? Keep the investigative standards high with a practical and auditable series of protocols that required investigating officers to act fairly and proportionally. This would be ‘Public Body accountability’ in action.  

I recall when the RIPA law came in, hard working, ethical Police Officers welcomed the greater accountability and transparency and to this day, the law continues to ensure there’s the right level of oversight and accountability when a suspected person is out under electronic or physical surveillance. 

My personal rule of thumb in these matters was always to regard such (surveillance) action as extremely invasive and therefore should be reserved for the most serious crimes and when other investigative channels have been exhausted. 

So wind forward nearly 25 years the UK’s Regulation of Investigatory Powers Act 2000 (RIPA), along with the additional features of The Investigatory Powers Act 2016 (also known as the "The Snoopers Charter") that expanded the obligations of Public Bodies to include the intelligence agencies and their role in conducting surveillance, intercept communications, and collection data for national security and crime prevention purposes. Public Bodies includes any organization or entity that is considered a public authority or governmental body. These public bodies have legal authority to perform certain functions and duties on behalf of the government or the public. Think Police, Customs, Health and Social Care organizations, Local Authority fraud teams and so on.  

A breach of RIPA can result in Civil and/or Criminal proceedings and fines or compensation for organizations or even imprisonment for individuals. 

Applicability to Non-Public Organizations 

So it looks like the UK’s Public Bodies are well covered by RIPA and the public protected from investigative ‘fishing expeditions’ or the random, prejudicial targeting of suspected individuals without evidence thus rights and privacy are better preserved and investigators try harder and do better work! 

So what about investigators working in private companies and corporations? Again, a corporation is a Private, not Public Body therefore not covered by RIPA and similar protective laws. Examples of roles out of scope include the conduct of in-house corporate lawyers, investigators, contracted forensic experts, Human Resources managers and Employee Relations personnel. 

One would hope that the same protections would be in place. In fact, with all the financial resources available to these profitable companies versus hard strapped Public Bodies that rely on government funding, one might also expect the highest interpretation and adoption of equivalence (to RIPA) as it pertains to corporate investigations. Not so. Research suggests there is little qualification, observance or even understanding of the rule of evidence and investigations let alone its practical application. Seems odd given the consequences of a botched Corporate investigation (termination of employment, professional stigmatization, lack of recourse etc.) could actually be worse than any sentence imposed by the criminal courts. 

Fixing the Issue 

To ensure integrity and fair outcomes, unless corporations demonstrate a willingness to self-regulate then existing protective laws and/or new laws should mandate that corporate investigations be conducted by independent, highly skilled investigators under strict regulations and independent oversight. That doesn’t mean using sycophantic external law firms commissioned by the corporation who will gladly dance to the corporation's tune for the right price.  

Employees must be (very) well-informed about their rights and receive mandatory independent legal counsel to prevent investigative malpractice and minimize the potential for miscarriages of justice. Legal departments should care at least as much about individual human rights as they do about protecting the reputation and profitability of the company. 

Pretext and entrapment practices and example of which is use of the expression: “If you have done nothing wrong, then you have nothing to fear!” is plainly wrong and should stop. It has nothing to do with who is right or wrong, innocence or guilt. The stakes are too high and miscarriages of justice happen all the  time even when investigations are regulated. 

Works Councils and Unions should play a more proactive role in ensuring adequate oversight and better protect employee rights with regard to investigations. Corporations should produce, publish and socialize official policies and investigative procedures as it pertains to the way inventions are managed. 

As an employee, you will not be granted the same rights and opportunities to challenge the evidence as you would if you were being investigated as a suspect in the criminal justice system. Corporations are simply not held to the same rules as Public Bodies. For example, you will probably not be able to conduct your own “discovery” (for example, documentary evidence on corporate systems) nor be furnished with complete data in order to formulate a defense or more importantly, establish the truth. 

Bottom Line 

We know in the Post Office’s bungled, misguided investigations, and maliciously prosecutions hundreds of subpostmasters knowing their evidence was flawed but nevertheless, the exeterted immense corporate power over the weak and vulnerable. This directly led to destroyed lives, financial ruin, wrecked careers, broken homes, mental health issues and tragically, resulted in at least one suicide. All innocent victims of an over zealous, profit driven, inhuman corporation now it seems, if the inquiry is anything to go by, led in part, by hypocrites, liars and cheats.

Advice to Employees  

If you are ever subject to an investigation, then it’s worth considering the following: 

1. When confronted with a situation, take your time to consider what is being alleged and ask to see that allegation in writing and the supporting evidence and refrain from making any statement until you have all the facts you need.
2. Know your legal rights. I’ve listed some of the relevant legislation below. Read and keep copies of the company’s policies and procedures to hand as these should form the basis of any investigation. Ask for copies and review all and any associated policy and procedural documents both relating to the issue at hand and the way it is to be managed by the company. 
3. Think before you write anything in work related apps or software or personal apps on work devices. The corporation is able to search and extract your words and present them with their own wrapper meaning their narrative and context. It’s unlikely you will be afforded the same opportunity in order to correct misconstrued statements. 
4. Never, ever be interviewed without taking legal advice or at least speaking to a lawyer first. Treat all allegations and investigations as serious no matter how trivial it may seem to you. 
5. Insist on legal or union representation during any interview. It is legally possible in most countries to do so but employees don't want to appear "guilty" so they engage alone. 
6. For matters that may involve allegations of a criminal nature, then only engage the company via your lawyer and after having obtained detailed, independent legal advice. 
7. Do not act under duress. If you are stressed, ill, confused, anxious etc. about the investigation, then you’ll probably not act rationally. Either report sick or get well first. 
8. If you have access to a Works Council or Trade Union, then use it. 
9. As much as a company believes they are keeping investigations confidential or quiet, it’s almost impossible for them to do so. Be prepared for this and the impact it will have on your health and wellbeing including the colleagues and  teams of those who are involved. 
10. Always ask for advance information and disclosure (of the allegation and associated evidence) and take time to examine it before responding to the company’s questions. 
11. You don't have to surrender personal devices or disclose information of a private nature stored in personal applications to an investigator if asked. Keep personal information and business data separate including separate devices. 
12. Supposedly “independent” law firms instructed by the company are not independent. They are paid for by the company and have the company’s interests at heart.
13. Be wary of casual ‘pretext’ invitations such as “we just need to chat” or “let’s meet and talk about it over coffee”.
14. People managers are more susceptible to malicious complaints. That said, the investigator is likely to take the complaint on face value without examining the possible motivation of the complaint or credibility of the complainant.
15. Investigations and their outcome decisions shouldn't be subject to arbitrary acceptance. For the reasons stated in this article, investigators, especially unqualified/inexperienced ones, get it wrong. They may also be strongly biased towards the company. Be prepared to fight for the truth and justice. 

Applicable Laws (examples) 

Some key laws and regulations that may be relevant to the behavior of investigators in corporate settings include:

1. Data Protection Act 2018 (UK): The Data Protection Act 2018, which incorporates the General Data Protection Regulation (GDPR) into UK law, sets out rules for the processing of personal data, including the collection, storage, and use of information obtained during investigations.
2. Human Rights Act 1998 (Europe): The Human Rights Act 1998 incorporates the rights enshrined in the European Convention on Human Rights into UK law. This legislation requires investigators to respect the right to privacy, the right to a fair trial, and other fundamental rights during the course of investigations.
3. EU Whistleblowing Directive The EU Whistleblowing Directive is legislation aimed at providing a high level of protection to whistleblowers across European Union member states. It sets out rules for reporting breaches of EU law in various areas, including public procurement, financial services, product safety, public health, data protection, and more. The directive establishes standards for protecting whistleblowers from retaliation, ensuring confidentiality, and providing support and legal advice. The directive requires organizations with more than 50 employees or with an annual turnover of over €10 million to set up internal reporting channels for whistleblowers. It also mandates EU member states to establish independent national authorities to receive and follow up on reports. The EU Whistleblowing Directive aims to increase transparency and accountability in both the public and private sectors by encouraging individuals to report wrongdoing without fear of reprisal.
4. Employment Law: Various aspects of employment law, such as laws related to employment contracts, workplace surveillance, and employee rights, may govern the behavior of investigators within corporations, particularly in cases involving employee misconduct or disciplinary proceedings.
5. Regulatory and Industry-Specific Laws: Depending on the industry in which the corporation operates, there may be specific regulations that govern investigations, compliance requirements, and reporting obligations. For example, financial services firms are subject to regulations imposed by the Financial Conduct Authority (FCA) and Prudential Regulation Authority (PRA).
6. Civil and Criminal Laws: Investigators within corporations must adhere to relevant civil and criminal laws, such as those relating to defamation, harassment, trespass, and fraud, when conducting investigations.

About the Author 

Spencer Mott is an accomplished security executive with 24 years experience as a Chief Information Security Officer, CSO and CIO of some of the world’s largest corporations and  across a range of industries including computer games, healthcare, biotechnology, travel and finance. He is also a former Scotland Yard detective having served in London, UK. He has worked internationally throughout his career and holds a number of technology patents, has written authoritative articles, speaks at conferences and now runs his own consultancy business from Sweden. His passion is social justice and the role and influence of big business in society.