;)
It would be reasonable to associate the following headlines with the recent News Corp. scandal. It would also be wrong. In fact, the reports are drawn from five other high-profile situations involving botched investigations that occurred over the past five decades. Rather than serving as cautionary tales about the need to protect companies against the reputational risk – even enterprise risk – of overstepping investigative bounds, history has repeated itself, time and again.
“CEO Apologizes For Spying; As Governmental Queries Escalate, Company Pulls Out Of Key Transaction”
“Runaway Investigation Brings Down Senior Executives; Criminal Charges Loom”
“Company Snooping Sparks Probe; Interception of Calls Draws Government Inquiry”
“Company Spy Saga Widens; Company Says Surveillance Wasn’t Carried Out By Its Own Employees”
“Politicians Want Blood After Spying Scandal; Company’s Number Two Executive Is Ousted”
Ernest Brod
Investigative stumbles involving major companies date back to 1968 with General Motors’ highly intrusive investigation of Ralph Nader, who had written a book critical of the Corvair car. When GM’s actions became public, the outcry spawned executive firings and Congressional hearings. More than 30 years later, Hewlett-Packard’s investigation of a boardroom leak gained by tricking a telephone company into revealing personal customer information, brought the term “pretexting” into the mainstream and led to criminal charges, Congressional investigations and the passage of new legislation. And, yet, lessons remained unlearned.
Less than two years later, Walmart found itself in the headlines, in front of Congress and facing criminal charges after its investigators were caught intercepting telephone messages of newspaper reporters, employees, stockholders and critics. And in a virtual replay, in 2009 Deutsche Bank’s outside investigators were discovered spying on the company’s board members in connection with a leak. The sorry parade of repeat performances begs the obvious question: Why do investigative scandals keep happening?
Corporations are often not as sensitive to the risks involved and are sometimes careless in selecting an investigator. Under pressure to achieve results, they may fail to set the scope or ask the tough questions of the investigators. And, in their eagerness to satisfy clients’ needs, some investigators may cross the thin line that exists between creative investigative procedures and dangerous activities.
Notwithstanding the risks, companies are still required to conduct investigations in a range of circumstances, including whistleblower allegations, regulatory inquiries, trade secret theft, counterfeiting of products, employee controversies and disability claims. In today’s climate, senior management, boards, and inside and outside counsel must weigh numerous considerations.
1. Is an Investigation Necessary?
Investigations should be launched only after carefully assessing risks and rewards. Is an investigation vital to the company’s interests? (Has there been a theft of trade secrets or a serious whistleblower allegation?) Or, are company officials overreacting to a perceived threat?
2. Internal or External Investigators?
The next step is to decide whether to conduct the investigation in-house or engage an outside investigator. Internal investigators or security staff may be motivated to satisfy their “boss,” and be tempted to push the envelope. For more than routine matters, companies would be well served to seek an outside specialist with the objectivity, experience and resources.
3. Who’s In Charge, and What Are the Rules of the Road?
It is imperative that the company establish clear and proper governance: Who will be responsible for supervising the investigation and make key decisions? Will the general counsel be involved? The CEO? The board? The need for early governance cannot be overstated so that the company can protect itself against potentially embarrassing problems before the investigation even begins. This is especially important in light of the possible damage to a company’s reputation if it is publicly identified with investigators’ alleged wrongdoing. Companies have been slow to set up controls to govern their investigative activities. Is there a corporate Director of Investigations? Where should the position report? Are there written procedures for the supervision and conduct of investigations, including acceptable actions? The well-prepared company will have an outside consultant perform a “diagnostic” of the firm’s approach to investigations.
4. Acceptable Tactics
The company and investigations firm should agree on acceptable investigative tactics. In determining the specific techniques to be used, clients must always consider their reaction to media disclosure. In certain situations, some actions are easily defensible – as when company trade secrets are stolen or products are counterfeited. They may not be as easily defended when a CEO is upset by a rumor about him on the Internet.
Until the “The Telephone Records and Privacy Protection Act of 2006” came into effect, federal and state laws were murky about whether “pretexting” a phone company was illegal. The most applicable federal statutes – the Fair Credit Reporting Act and the Gramm-Leach-Bliley Act – referred specifically to obtaining financial information fraudulently. But is all pretexting illegal?
For example, an investigator checking the counterfeiting of a client’s watches may pose as a customer to purchase suspect watches from a street vendor. In trying to obtain intelligence about the alleged theft of a client’s trade secrets by a competitor, an investigator may contact the competitor company. The investigator may claim he or she “is working with a consulting firm,” or is “doing a research project,” or has been “asked to get this information by my boss.” Such mild pretenses are not usually objectionable. However, the investigator would cross the line if he identified himself as someone else, or claimed/implied a connection with a law enforcement organization.
What about the propriety of other common investigative activities?
Investigative Research– Sophisticated research and analyses of “open sources” for public record information is the most common investigative approach. It may lack drama but it is often the most efficient and cost-effective way to obtain information. The gathering of such data raises no legitimate legal or ethical issues.
Surveillance — Surveillance is expensive, complicated and risky. Unless the surveillance is intrusive enough to constitute harassment, there are usually no legal issues. But, if the surveillance becomes known, it is likely to be described in the media as “snooping” or “spying,” and could create a public relations nightmare.
Recording Conversations — Using equipment to listen to, or record, conversations without either party’s consent is usually illegal. There is a common misconception that legality depends on the right of the person placing the equipment to have access to the premises. A few years ago, a prominent politician found trying to place a “bug” on the family boat – to catch her husband in compromising circumstances – learned that regardless of her right to be on the boat, there must be consent by at least one party to a recorded conversation.
Searching Trash — Known as “dumpster diving,” the collection and search of refuse by investigators may be legal, if the trash has been disposed of in a manner that indicates there is no “expectation of privacy.” Even when conducted legally, it could result in negative publicity for the client and investigator if the practice becomes known.
5. Selecting an Outside Investigator
The need to inaugurate an investigation is almost always generated by a crisis, yet companies sometimes lose sight of the distinction between “gumshoe” and “white shoe” investigation firms. Establish mechanisms to monitor investigators’ activities and guard against impropriety (or worse) through a risk management group and/or internal general counsel. Get recommendations from people you trust and ask for references. Determine how the firm monitors its own activities, and make sure that the people you meet will work on your investigation. Ask about their use of outside subcontractors, and how they supervise them. Make sure their retention letter warrants that only legal methods will be employed.
In the final analysis, whether working with inside or outside investigators, companies must look for people with the reputation, experience, and culture that conforms to the physician’s Hippocratic Oath – “First do no harm.”
Ernest Brod is a managing director with Alvarez & Marsal Dispute Analysis & Forensic Services and leads the firm’s Business Intelligence practice.
Excellent article Mr. Brod! These are certainly sound concepts that all of those involved in internal investigations should keep in mind.