Workplace Investigations – From the FSO Perspective

1. Workplace Investigations – From the FSO Perspective Rick Harper, CPI JSAC 13 April 2011

2. I’m told speakers are supposed to tell you a bit about themselves. Here’s all you need to know to know me: JSAC 13 April 2011

3. JSAC 13 April 2011

4. Why Worry About Investigations? • You’re probably aware of the traditional things FSOs are required to investigate, document and report…for example: • Failure to follow Security procedures for protecting classified information • Potential or actual compromise of classified information JSAC 13 April 2011

5. Why Worry About Investigations? • …But don’t be surprised if at some point you’re asked to investigate something outside the norm, for example: • Inappropriate behavior • Timecharging • Misuse of Assets/Property • Conflict of Interest • Theft • Performance/Workmanship/Product Integrity …because after all, you’re Security…and isn’t that kind of like being a cop? JSAC 13 April 2011

6. Workplace Investigations – From the FSO Perspective…Our Agenda: • The investigative cycle • Tips for handling all those things you might have to investigate • Pitfalls to avoid JSAC 13 April 2011

7. But Before We Start…Let’s See How Many Investigators We Already Have • Let’s play “who’s probably the guilty party?”…or, “how to solve the case in one lucky guess.” For each category, tell me whodunnit: • Anonymous malicious acts (e.g., harassing notes left in work area) • Minor item theft (e.g., coffee fund, iPods from desks) • Major item theft (e.g., laptops, projectors, lumber) • Food/Coffee theft • Weird, unexplainable stuff (let your imagination run wild) JSAC 13 April 2011

8. The Investigative Cycle • Intake • Determine the elements of proof • Prepare an investigative plan • Conduct the investigation • Document the results JSAC 13 April 2011

9. The Investigative Cycle – Intake • Form whence did the case come? Sources for referral or approval may include: • Senior Management • Human Resources • Law Office • Ethics • EEO • Security Management I recommend against self-initiated cases unless you get buyoff from one of the organizations above • Can you take the case? If you are a possible witness, stakeholder, or have a personal or reporting relationship with any of the principals of the case…recuse yourself if possible. JSAC 13 April 2011

10. The Investigative Cycle –Elements of Proof • Don’t just “start investigating”…know from the start what you’re looking for! • Carefully read what your company policy or procedure says…that will tell you what you have to prove/disprove Example: The following items are prohibited on company property…Illegal Narcotics and drug paraphernalia. (Medication prescribed by a licensed physician is authorized)… You have an allegation that an employee violated this rule. What do you have to prove or disprove? JSAC 13 April 2011

11. The Investigative Cycle –Elements of Proof Example: The following items are prohibited on company property…Illegal Narcotics and drug paraphernalia. (Medication prescribed by a licensed physician is authorized)… You have an allegation that an employee violated this rule. What do you have to prove or disprove? • The item in question was either a narcotic (!!!) or drug paraphernalia prohibited by law. • It was on company property. • It was in the possession of the employee in question. • The employee in question does not have a valid prescription for it. You have 4 elements of proof. Prove EACH one of those and you have a case…if you fail to prove ANY of them, you don’t. JSAC 13 April 2011

12. The Investigative Cycle - Prepare An Investigative Plan Write a brief plan to determine what you need to do to prove/disprove each element of proof, and in what order you should do it. The rule of thumb is: • If evidence or a scene needs to be preserved…do that first, and quickly!!! (consider photos, chain of custody tags, taping off the area) • Interview witnesses and any victim immediately, before memories get worse than they are already. • Do your research next • Public records if pertinent (careful – FCRA – play it safe, avoid third-party search firms) • Company data • Ask HR, Ethics – you may be surprised • Other data – video, gate records, payroll records, computer records, whatever might be pertinent • Conduct surveillance (video, phone record, computer, personal) if appropriate • Analyze the results • Use the results to formulate follow-up and/or additional interviews • Conduct the subject interview to confirm your findings and/or elicit a confession JSAC 13 April 2011

13. The Investigative Cycle – Conduct the Investigation (Research) Research sources include the following but are limited only by your imagination (and one good lawsuit): • Gate records • Company phone records • Personal phone records – hey, you can always ask… • Facebook, MySpace and Google are your friends • Internal Records (you may get a surprise!) • Public records • State • Texas DPS criminal conviction database • State Comptroller business incorporation records • County • County clerk has court records • Jail records • DBAs • Tax records • FCRA – beware third-party providers! JSAC 13 April 2011

14. The Investigative Cycle – Conduct the Investigation (Research) More research resources: • Surveillance • Video – Perimeter versus concealed camera • Computer • Company policy regarding expectation of privacy? • Warning on screen? • Coordinate with IT, HR and Legal • Do you know how to search? • User files • Recent docs • Activity/Security/Event logs • If not…Do you have an IT POC that can help? • Forensic viability of evidence • Download to media • Screenshot • Forwarding an e-mail • Personal JSAC 13 April 2011

15. The Investigative Cycle – Conduct the Investigation (Research) And even more research resources: • Personal cell phone, camera, purse searches • Posted implied consent? • Personal permission and presence • Coordinate with HR and Legal • Office Searches • Company policy regarding reasonable expectation of privacy? • Coordinate with HR and/or Legal • Beware represented lockers, toolboxes, etc. – regarded as personal property, you need subject permission and LR present to search JSAC 13 April 2011

16. The Investigative Cycle – Conduct the Investigation (Interviews) • Take notes – you’ll need them, but they can be discoverable • Name of interviewee, time, date • Quotes with time on significant phrases • Be careful what you write – no doodling or unprofessional comments • Get statements • Handwritten, signed, pages numbered and blank spaces crossed out best • time-consuming • hard to ensure all pertinent points covered • Their e-mail acceptable • faster, but once they leave… • hard to ensure all pertinent points covered • Get signed copy later if you can • Retain electronic copy • Your summation acceptable if sent/returned, better if signed/faxed • Eats up your time, but all points covered • Retain electronic copy JSAC 13 April 2011

17. The Investigative Cycle – Conduct the Investigation (Interviews) • Don’t record – even with consent, more harm than good • Represented employees and Weingarten • Incidental/witness – can dismiss representation, but get it in writing and with OK of LR • Subject • Location • offsite? • personal residence? • their office? • Your office? • conference room? • interview room • Interview room arrangement and furnishing • Personal positioning • One interviewer • One interviewer and one witness • Never subject interview a member of the opposite sex alone, unless it’s during working hours, the door is open and you have reliable witnesses within earshot JSAC 13 April 2011

18. The Investigative Cycle – Conduct the Investigation (Interviews) • Witness? Pros and cons – • Corroboration • Safety • Opposite gender • Chilling effect • Distraction from interviewer • Freedom to leave • Never raise your voice or lose you temper • Unproductive…sometimes the quietest voice speaks the loudest • “The first guy to speak bought the policy” • Immediately interview witnesses and complainants • Objective is data gathering • Free form – let them talk, then go over their responses and your questions to make sure you’ve gotten all you can JSAC 13 April 2011

19. The Investigative Cycle – Conduct the Investigation (Interviews) • Do the subject interview last if possible • Minimizes the possibility of corruption of the investigation • You now know a lot about the case…and you can’t know too much when going into a subject interview • If the evidence at this stage is not strongly indicative, your objective is just fact finding and confirming the results. • If the evidence indicates the subject probably committed the act in question, you have 2 likely objectives: • Gain confirmation of the indicative evidence (example: real estate case) • Obtain a confession. JSAC 13 April 2011

20. The Investigative Cycle – Conduct the Investigation (Interviews) • The subject interview is structured - not free form • Have your questions in a sequence designed to gain the result you need • Have the subject initial the policy requiring truthful cooperation in an investigation (if your company has one!) • Sets the proper psychological tone • Deterrent to deception • Inform them of the allegation and ask for their explanation • Gives them a chance to lie and put that lie in writing (remember that policy requiring truthfulness in investigations?) • Confront with evidence • Provide an excuse, or a way out…but don’t lie or make promises! • USE: “that’s not really you, is it?” “I think it was someone else’s idea, wasn’t it?” “you didn’t mean to frighten her, did you?” “Would you like to lay this burden down?” “I think you want to do the right thing now, don’t you?” • DON’T USE: “If you tell me you did it I’ll forget the whole thing.” “You can save your job by giving me a statement right now.” • Then get the REAL statement Either way…Prepare. Then prepare again. A subject interview has nothing to do with a “fair fight.” It can make or break your case, and you only get one shot at it. You MUST go in with every advantage, knowing all the facts cold, with an objective in mind, and a questioning sequence to get you there. JSAC 13 April 2011

21. The Investigative Cycle – Document the Investigation • Write the report • Predication • Subject, Witness, and pertinent party ID • Background check results(internal and/or external, as appropriate) • Narrative – • summarize each item of research or interview conducted, in order, with explanation of why the research/interview was conducted and its results • Details (photos, spreadsheets, e-mails, statements, etc.) contained in Attachments • Conclusion • Not beyond a shadow of a doubt…not even beyond a reasonable doubt…just the preponderance of evidence • Deliver the report to the requestor. • Know your company’s retention policy and keep your notes, any evidence, and the report accordingly. JSAC 13 April 2011

22. Off topic…let’s pause for a moment I love photo or video evidence. It’s so irrefutable…or is it? Which photo clearly proves an employee was sleeping on the job? JSAC 13 April 2011

23. This one… (submitted by a complainant who took it from his personal cell phone…which, by the way, was a code of conduct violation itself…) JSAC 13 April 2011

24. …or this one? JSAC 13 April 2011

25. Remember the Things You Might Be Asked To Investigate? • Harassment or Intimidation • Vandalism • Felony arrests • Attendance • Profanity, deliberate inflammatory language, disorderly acts, sexually explicit, and lewd/obscene gestures or language • Participating in gambling or games of chance • Selling and soliciting or collecting money on premises, for purposes not authorized by your company • Display of materials which might be considered offensive or detract from a business-like environment displayed in work areas. • Unauthorized reproduction, distribution, or posting of materials or removal of Company-approved notices or signs without authorization • Misappropriation of travel funds • Theft • Timecharging • Possession of contraband • Misuse of Assets (personal e-mail, running outside business, etc.) • Travel Fraud (dodge product integrity, embezzlement, and similar things unless you are trained and qualified) JSAC 13 April 2011

26. How would you investigate an inappropriate behavior case? Let your imagination roam free… • If you have a “crime scene,” photograph it and seize/chain of custody any evidence (notes, photos, whatever) • Do initial interviews of complainant and witnesses • Recurring harassment? Maybe covert targeted surveillance. • Find the ubiquitous snitch (every pot has a lid, every cloud has a silver lining…and everyone has someone who doesn’t like them) • Have a suspect yet? • Gate records • Phone records • Perimeter video surveillance • E-mail/IM /HD (see IT…and if they’ve been erasing e-mail, maybe it’s in archive folders…maybe it’s in a server…maybe it’s on an archive tapes…as a last resort check their blackberry…) • Text messages records (company, personal…careful!) • Does the accumulated evidence confirm your likely suspect? Then it’s off to the subject interview • A nice, barren, private location • Read ‘em their rights • Explain the allegation • Give ‘em a chance to lie • Confront the lie • Get the confession • Take the statement! JSAC 13 April 2011

27. Pitfalls to Avoid • FCRA • False imprisonment • Coercion • HIPAA • No improper intake, no “favors” • Child pornography • Workplace searches • Implied consent vs. personal property (car, purse, cell phone, camera, tool box) • Closed office or cubicle? • Lockers – their lock or ours? See LR JSAC 13 April 2011

28. Pitfalls to Avoid • Pretexting • Interviewing opposite gender alone • Defamation • Public surveillance (may require license – know your state law) • Electronic surveillance • IT assets • Audio (e.g., voice mail – do not record phone calls unless both ends are in a two-party state) • Video • Management approval first • Reasonable expectation of privacy rule • Closed offices • Restrooms/locker rooms or view into JSAC 13 April 2011

29. Some VERY Random Closing Tips • Beyond a shadow of a doubt, preponderance of evidence, or a good faith investigation? • Never preconceive. Never. • Keep your customer informed, but don’t predict your conclusions. • Don’t release partial, draft or advance copies of reports. • Witnesses are funny things • Did they see/hear what they thought they saw/heard? • Bias/agendas • Fear and loathing vs. the ties that bind • “Has anyone discussed this case with you or coached you in any way?” JSAC 13 April 2011

30. Workplace Investigations – From the FSO Perspective…Our Agenda: • The investigative cycle • Tips for handling all those things you might have to investigate • Pitfalls to avoid JSAC 13 April 2011