Page 173 - Deception at work all chapters EBook

174 Deception at Work

COMPUTER EVIDENCE

Legality

Particular attention should be paid to the acquisition and preservation of computer evidence.
Again, the investigator must comply with a raft of new legislation. Computers owned by the
company can be accessed overtly or covertly without the user’s permission when crime is
being investigated. However, it would be illegal to access a laptop computer, Personal Desktop
Assistant (PDA) or mobile telephone memory owned by an individual, even when it is on com-
pany premises, without his permission. If he has used diskettes paid for by the company, even
on his personal computer, there is a strong argument that they can be copied and examined
without his authority.

The Regulation of Investigatory Powers Act 2000, gives government investigators the right
to demand the production of encryption keys. There is no equivalent in the business world.
Thus businesses should address this issue in their fraud policy (see page [xref]).

Evidence required

Wherever possible, original media, such as disks, diskettes, tapes etc. should be obtained.
There are two main reasons for this:

• Admissibility: The courts in most countries have ruled that, to be held admissible, computer
evidence must have been produced in the normal course of business and on a machine of
proven reliability. Copies taken for other than normal processing requirements or special
reports might be inadmissible.

• Integrity: It is possible original computer media contains data in image or digital form which
will not be read by a copy program. For example, deleted files remain on the original disk
until their space is overwritten by new data but are not read by normal copying and back-
up utilities. Thus computers should only be examined by qualified experts so that full and
accurate images are obtained.

CONCLUSION

The laws are complex and evolving. It is essential that investigations comply with the highest
legal and ethical standards, while standing a realistic chance of exposing crooks. Balance (or
proportionality) is critical as is good advice from experienced litigation lawyers especially in
difficult or complex cases.

However, the bottom line is – that despite the cravings of the Information Commissioner
and other jobsworths, the law does not prohibit piercing investigations and interviews when
crime is suspected.

Steps in an investigation

OVERALL PLAN

Most major investigations should be planned in the following stages (see Table 5.7:
Column 1 shows that time should be taken in planning the first step, which is the point

at which those under suspicion first get to hear that this is the case. The first step must be an
ambush.