Contemporary Security Management Chapter 13 Managing Investigations

1. Contemporary Security Management Chapter 13 Managing Investigations Chapter 13 - Managing Investigations

2. Case Management 201 • Investigation cases are managed by the CSO and the task involves several responsibilities. • Infrastructure: • Defining the mission of the investigations department • Writing policy, rules, and procedures that set parameters and provide performance guidance. • Establishing a “chain of command” within the investigations department. • Granting authority and delegating responsibilities. • Acquiring physical resources such as vehicles, cameras, video recorders, weapons and confidential funds for meeting “off-the-book” expenses. Chapter 13 - Managing Investigations

3. Case Management 201 • Acquiring human resources, specifically investigators with skills that align with the department’s mission. • Providing opportunities for investigators to improve their skills and acquire new skills. • Linking the department with other company departments such as the auditing department for identifying fraud and the legal department for obtaining legal guidance. • Linking the department with external organizations such as law enforcement departments and prosecuting agencies. Chapter 13 - Managing Investigations

4. Investigation Types 204 • Two categories of investigation: • Constructive investigations are covert in nature. • These types of investigations might be in process while the suspected activity is taking place or is anticipated. • For example: investigating complaints again management • Reconstructive investigations are those that are conducted and must be recreated after the fact. Chapter 13 - Managing Investigations

5. Preventive or Pre-Emptive Investigations 204 • Economic or industrial espionage • Larceny, burglary, bribery, extortion, and blackmail. • Unethical forms of espionage include: • Moles, searching trash, sympathizing with disgruntled employees, and tricking researchers to reveal senstive information in speeches or scientific papers or during a false job interview. Chapter 13 - Managing Investigations

6. Due Diligence Investigations • An examination by a company's investment bank and accountants of the company's management, operations, financial condition, competitive position, performance, and business objectives and plan, as well as information regarding the company's labor force, suppliers, customers, and industry. • This is under taken prior to signing a contract Chapter 13 - Managing Investigations

7. Administrative Inquiries 206 • This is a fact-finding investigation that may be used to determine matters of interest or incidents that may harm an organization: • In the inquiry stage, factual information is gathered and expeditiously reviewed to determine if an investigation of the charge is warranted. • An inquiry is not a formal hearing or an in-depth analysis of the allegation; it is a process to determine whether there is enough evidence of misconduct to have an investigation. • As soon as sufficient information is obtained that indicates an investigation is warranted, the inquiry process terminates, and an inquiry report is prepared. Chapter 13 - Managing Investigations

8. Internal Theft Investigations • Employee theft is the most frequently investigated of incidents: • Three imperatives apply: • Decide that internal theft is unacceptable. • Do something about it. • Involve employees in bringing it to an end. Chapter 13 - Managing Investigations

9. Internal Theft Investigations • Employee theft generally fall into the following: • 25% of employees is consistently honest • 25% are outright thieves • The honesty of the remaining 50% is up to management. This half can go either way depending on opportunity. • Note: the cost of crime to businesses is in excess of $40 billion per year. Chapter 13 - Managing Investigations

10. Causes of Internal Theft • Employees choose not to report internal theft. • Some employees are not aware of theft around them. • Some employees will take action only after theft reaches a particular level. • Some employers know about theft yet choose to do nothing about it. It is sometimes a form of restitution. • Some employers and employees believe that theft is a normal way of life. • Many employees have never been told not to seal or that sealing has consequences. • Low-pay employees justify theft • White-collar crime • New employees are more likely to steal Chapter 13 - Managing Investigations

11. Signal of Theft by Employees • Gambling • Borrowing • Living above apparent income level • Writing bad checks • Indebtedness • Drug and alcohol abuse Chapter 13 - Managing Investigations

12. Crimes Committed • Fraud Investigations • Medical Fraud • Bid Rigging • False Billing • Workers’ Compensation • Bribery Chapter 13 - Managing Investigations

13. Compliance Investigations 213 • A compliance investigation is launched when an organization learns that is officers or other senior managers have engaged in misconduct that may expose the organization to criminal or civil liability or administrative sanction. • The overall goal of the investigation is to gather information for the purpose of reducing punishment of responsible individuals or fines imposed on the company. Chapter 13 - Managing Investigations

14. Computer Crime 213 • The Computer Fraud and Abuse Act (CFAA) was enacted by Congress in 1986 as an amendment to existing computer fraud law (18 U.S.C. § 1030), which had been included in the Comprehensive Crime Control Act of 1984. • The Act has been amended a number of times—in 1989, 1994, 1996, in 2001 by the USA PATRIOT Act, 2002, and in 2008 by the Identity Theft Enforcement and Restitution Act. Chapter 13 - Managing Investigations

15. Computer Crime 213 • The CFAA defines computer crime as an act punishable by law when an automatic electronic device that performs mathematical or logical operations is used to commit crime, or damage, destruct, compromise, manipulate, or otherwise interfere with information owned by another party. • Computer crime is estimated at over $62 billion per year. Chapter 13 - Managing Investigations

16. Computer Crime 213 • Recommend protective steps: • Establish policies and work rules governing appropriate and inappropriate use of computers. • Develop and enforce strict password rules. • Establish procedures for auditing user accounts, computer accounts, and servers. Prohibit employees from holding in their personal possession sensitive information, including intellectual property. • Prohibit employees from holding in their personal possession sensitive information, including intellectual property. • Discipline employees that allow unauthorized access to their computer. • Regulate changes to phone numbers, fax numbers, e-mail addresses, and entry to the Internet and intranets. Chapter 13 - Managing Investigations

17. Undercover Investigations 214 • This should be considered when a criminal activity is affecting a business but the details are unknown and proof is needed to bring it to an end. • Hire the operative under various pretenses • Operative’s job is to ascertain the who, what, where, when, why and how. • Operative’s job is to befriend a member of the criminal group • Avoid entrapment: i.e., working with the police. Chapter 13 - Managing Investigations

18. Physical Evidence 216 • Evidence is anything that tends to prove or disprove a fact. • Three categories of physical evidence: • Movable evidence • Fixed or immovable evidence • Fragile is an item that is easily lost, destroyed, contaminated, or subject to degradation. • All evidence needs to be protected Chapter 13 - Managing Investigations

19. Evidence Collection 217 • Identification Markings • Mark all evidence as soon as discovered. • Evidence Tag • Tags are attached to evidence at the time the evidence is acquired. • Chain of Custody • A written recorded of all the people who have handle the evidence. Chapter 13 - Managing Investigations

20. Qualitative and Quantitative Analysis 218 • The difference between qualitative analysis and quantitative analysis is that quantitative analysis focuses on measurements and statistics, while qualitative analysis focuses on only quality. • Qualitative analysis - Establishes what the sample is • Quantitative analysis - measures how much Chapter 13 - Managing Investigations

21. Read pages 218 to 228 on your own Chapter 13 - Managing Investigations

22. The Deposition 227 • A deposition is an out-of-court proceeding conducted for the purpose of preserving the testimony of the investigator-witness for later us in court. • Those present • Investigator • Lawyers for both parties • A court reporter Chapter 13 - Managing Investigations

23. The Deposition 227 • A deposition is the taking of an oral statement of a witness under oath, before trial. • It has two purposes: • To find out what the witness knows, and to preserve that witness' testimony. • The intent is to allow the parties to learn all of the facts before the trial, so that no one is surprised at trial. • Contrary to what you see in the movies, springing a surprise witness at the eleventh hour of a trial is regarded as unfair. • By the time a trial begins, the parties should know who all of the witnesses will be and what they will say during testimony. Chapter 13 - Managing Investigations

24. Discovery • Discovery, in the law of the United States, is the pre-trial phase in a lawsuit in which each party, through the law of civil procedure, can obtain evidence from the opposing party by means of discovery devices including requests for: • answers to interrogatories, requests for production of documents, requests for admissions and depositions. • Discovery can be obtained from non-parties using subpoenas. • When discovery requests are objected to, the requesting party may seek the assistance of the court by filing a motion to compel discovery. Chapter 13 - Managing Investigations

25. Discovery 227 • The common or traditional forms of discoverable materials include: • Reports, photos, medical images, drawings, reconstructed video, video and audio tapes, e-mail, fax, achieves, and data drawn from a variety of sources. Chapter 13 - Managing Investigations

26. Discovery 227 • Technology that is included: • Servers • Hard drives • PCs • Laptops • USB flash drives • iPods and similar devices • Any material that appears to have been deleted from a hard drive, but can be captured by computer forensic specialists • Internet sites such as Youtube, Facebook, and MySpace. Chapter 13 - Managing Investigations

27. Trial Procedures 229 • Voir Dire:The preliminary examination of prospective jurors to determine their qualifications and suitability to serve on a jury, in order to ensure the selection of fair and impartial jury. Chapter 13 - Managing Investigations

28. Civil Justice Procedures • Plaintiff • Defendant • Opposing attorney confer and communicate issues, evidence, and settlement options. This may take may at anytime. • Discovery: opposing attorney obtain factual information from it other. In other words, to see what the other side has. • Motions filed in court. this request a judge to act upon something. Example, a motions to dismiss charges. • Answer is the response to the law suit. It includes denials and counterclaims. • Pretrial conference: the stage in which opposing attorneys and the judge meet to work toward settlement or face trial. • Voir Dire:The preliminary examination of prospective jurors to determine their qualifications and suitability to serve on a jury, in order to ensure the selection of fair and impartial jury. Chapter 4 - The Law

29. Civil Justice Procedures • Opening statements: comments made by opposing attorneys who explain facts to the judge and jury once the trial begins. • Presentation of plaintiff’s case by plaintiff’s attorney. Presents evidence, witnesses and documents to support allegations in the complaint. • Defendant’s motion for dismissal. If denied, the trial continues. • Presentation of defendant’s case: defendant’s attorney presents evidence to disprove (rebut) the plaintiff's case. • Plaintiff’s rebuttal: plaintiff’s attorney attempts to disprove the presentation of the defendant’s attorney. • Defendant’s rebuttal: defendant’s attorney attempts to disprove newer issues argued by the plaintiff’s attorney. • Motion for directed verdict: either one or both parties can ask the judge to order a directed verdict, which excludes the jury, from making a decision when the evidence does not support a conviction. Chapter 4 - The Law

30. Civil Justice Procedures • Closing arguments: are summaries of the evidence presented to the jury by the plaintiff’s attorney and the defendant’s attorney. • Judge’s instructions are given to the jury. • Jury verdict: occurs when the jury makes a decision. • Posttrial motions: occur after trial. Example, motion for a new trial. • Judgment occurs when the judge declares which arty prevailed at the trial and the amount of recovery to be awarded. Chapter 4 - The Law