Our Sandra Desautels and Daniel Gill discuss conducting investigations during the COVID-19 pandemic with Corporate Disputes Magazine. Download the full article to learn more from Pillsbury Winthrop Shaw Pittman LLP experts Deborah S. Thoren-Peden, Cassie Lentchner and Aaron S. Dyer who participate in the discussion.
What do you consider to be among the major trends shaping internal investigations in recent months? To what extent have you seen an uptick in their frequency?
Desautels: The global pandemic has highlighted areas of vulnerability, from internal and external sources. Many diverse industries have seen an increase in referrals for internal investigation. The allegations range from conflict of interest matters to misappropriation of customer and employer funds. Notably, the initial increase of referrals seemed to be a result of heightened awareness and enhanced controls implemented in response to new threats, instead of more incidents.
Gill: The pandemic has resulted in significant work for investigation teams for cyber security concerns and a surge in demand for computer forensic services. With the majority of personnel working remotely, the ability to forensically capture and analyze relevant computer data became critical. Companies with in-house capability sometimes identified gaps in their current skills or processes, such as incomplete data capture, or lack of knowledge about data forensic tools to ensure appropriate chain of custody. For investigations that may result in litigation, remediation of such items is critical.
What are some of the underlying drivers and common themes among investigations? How prevalent, for example, are fraud-related investigations?
Desautels: The increase in remote users, combined with the disruption caused by the global pandemic, created a perfect storm for fraud from both internal and external sources. We saw many law enforcement agencies across the globe issue alerts about fraud related to coronavirus (COVID-19) equipment, financing and tenders. There also were warnings about other fraud schemes such as identity theft, money mules and exploitation of children and the elderly. A significant rise in reported cyber crimes was also evident, with criminals eager to take advantage of the increased use of remote workers and virtual environments, many deployed hastily and without robust controls. It is important to remember that when companies make things easier for customers or employees, they also make it easier for the criminals.
Gill: Criminals have historically responded to disasters and other crises by engaging in conduct seeking to exploit vulnerabilities related to these events. Common themes identified were higher volumes of phishing emails, penetration of inadequately controlled data warehouses, theft of intellectual property – internally facilitated and hacked – push payment fraud schemes and unauthorized participants during virtual group workshops.
To what extent have investigations necessarily evolved and adapted to a changing business landscape and the way companies now operate?
Desautels: Investigation teams have had to reprioritize their investigations, based on the available tools and focus of the investigation. Where investigations require forensic data capture or review of physical items, more lead time is needed to coordinate with internal and external partners, such as legal, IT and applicable vendors. Determining whether to proceed with virtual interviews is also an important consideration, with important consequences. For instance, can an employee be directed to attend an in-person interview at the workplace, or at an alternate site if the regular workplace is currently closed due to COVID-19 restrictions?
Gill: Many companies are also reviewing their internal fraud-detection mechanisms to enhance scenarios and refresh lists and examples of red flags. Several are also compiling guidance on acceptable types of supporting documents and methods of possible corroboration.
Drilling down, what changes are you seeing to the approaches, processes and tools used to conduct internal investigations, both remote and on site? To what extent are some of the more recent changes likely to persist into the future?
Desautels: Coordination between investigation teams, HR and the legal department is of increased importance. Proactive measures include updates to confidentiality agreements, remote work policies, the code of conduct or conflict of interest policy, and other related documents.
Gill: Investigation procedures and protocols are also being updated with remote interview considerations, since many companies are implementing permanent remote work options.
Based on your experience, what kinds of challenges have investigators been forced to surmount in recent months? What steps have they taken in response?
Desautels: Investigators have had to quickly adapt to virtual interviews, where typical nonverbal cues are not necessarily captured. Preparation for virtual interviews tends to take longer, with decisions on what technology to use and its capacities to share information and support side conversations, while protecting attorney-client privilege. Decisions regarding the use of technology and planning become strategic, including whether and how to present and share documents. Advanced planning is required for a parties’ internet connection being insufficient to allow for video connection, and parties that cannot access certain technology solutions. Related considerations include the review of timelines in service-level agreements and key performance indicators.
Gill: The ability to conduct investigations remotely has become essential. Some organizations have conducted workshops to refresh technology skills and share good practices for conducting interviews via video teleconferencing.
Could you provide an insight into data collection and information gathering issues, and related privacy concerns, that typically arise during an internal investigation? What considerations need to be made to address these aspects?
Desautels: Other data collection challenges arise when collecting data remotely, including how to do so without altering the metadata required for investigatory purposes. This raises key issues. For example, does data captured from a laptop via a virtual private network connection include documents on the local drive and desktop? Does the collection of unstructured data from a shared network folder, for instance, create a modified entry? Are there hard copy documents and other media with notes and comments, which were not collected and captured electronically because they are maintained in desks and other storage facilities?
Gill: Investigators must ensure the data collection and e-discovery teams clearly understand the type of data being sought and whether it must be forensically preserved. Equally important for investigators is to know any limitations in the collection process that could affect their analysis.
Desautels: Where the EU General Data Protection Regulation (GDPR) applies, the data collection process should include an approval from the responsible privacy officer to assess whether the request is proportionate to the purpose and scope of the investigation. In addition, the collected data should be safeguarded with appropriate access controls to ensure only authorized persons can see the information.
Looking ahead, how do you anticipate digital technology will evolve in the short and long term as a key part of the investigation process? What solutions and innovations can we expect to see?
Desautels: In the short term, virtual environments will likely deploy increased access controls and quality. Long term, we can expect integration of features such as micro-expression detection, voiceprint identification and analysis, and, possibly, machine transcription of virtual sessions.