Types of Investigations

Unlike criminal proceedings, a civil dispute involves a court but not a prosecutor. Civil law applies when a victimized entity sues the offensive party.

An investigation with the intended purpose of a lawsuit should involve the same degree of documentation and adherence to detail as a criminal investigation, because the organization will not be deciding the outcome but will be trusting the court to determine if either party owes restitution to the other. However, it is important to note that the level of scrutiny is less than that of a criminal case.

Some incidents may involve components of both criminal and civil actions; for instance, if the organization is hacked by a malicious attacker, the hack itself might be a criminal act (violating the law), and it might also cause damages for which the victim organization can sue the attacker.

In these situations, the parties to the civil suit can often use the evidence collected during the criminal proceedings to support their claims. However, civil courts usually also allow a greater breadth of evidence that may be presented in a more liberal fashion than in a criminal case - some of the restrictions placed on law enforcement when collecting evidence do not apply to victims in civil cases.

For instance, a law enforcement agency might need to get a court order to conduct network monitoring on a target environment, while the owner of that environment - the victim organization - is allowed to monitor activity within the environment and present resulting data without permission from the courts.

If an organization decides to become involved in a civil suit, it must be understood that the organization will be bearing the financial burden: attorneys' and court fees and so forth.

Sometimes, depending on the case and the jurisdiction, the winning side of a civil case may transfer this burden to the loser, but this is not always true, and that cost is only recovered after the court's decision; there is still a significant up-front cost in initiating the case. This differs from criminal actions where the government expends those costs.

Finally, another aspect to be aware of is the threshold of proof required. As previously mentioned, in civil cases, the burden of proof is usually much lower than in criminal cases (typically, civil cases are decided based on the preponderance of evidence, which means even a 51 percent/49 percent split in the evidence presented would be decided in favor of the party with 51 percent, while criminal cases usually require a much higher standard for conviction, such as "beyond a reasonable doubt").

Regulatory Investigation

Some investigations will be done by or on behalf of the regulatory bodies. When an organization is involved in regulated activity, that activity necessarily is subject to investigation by the pertinent regulator(s).

Regulators may conduct their own investigations, with or without law enforcement, and require the target organization to acquire and present information to the regulator or engage a third party to perform the investigation.

In many jurisdictions, regulatory investigation has the force of law, so it will have similar processes to criminal investigations but require a much lower threshold of access (regulators typically do not need warrants, court orders, or subpoenas to gather evidence) and a | much lower burden of evidence to make findings. In some jurisdictions, such as the United States, many regulators create regulations that have the force of law and are empowered to perform their own investigations. They may have their own officials who act as special prosecutors, and hold administrative hearings using a separate set of courts and administrative law judges.

Regulatory investigation may also occur when there is a violation of regulation, with some regulators having the power to open an investigation even if there was no criminal activity, but on the basis of violating that regulation. Examples for such investigations and procedures can be found in various privacy regulations around the world, in which investigation can start after a data breach. Such an investigation will focus on whether there was negligence from the company side and may place fines if the investigation finds that the company was negligent.

Criminal Investigation

When an organization believes that a crime has been committed, it must notify the applicable law enforcement entity and allow that entity to conduct the investigation. This may be handled differently in some instances and in different jurisdictions.

Some crimes, particularly where the only victim is the organization itself, may not require law enforcement involvement if the victimized party chooses to handle the matter in a non-judicial manner. However, making this determination can be difficult and risky, and the organization should consult with legal counsel before making this decision. When law enforcement conducts the investigation, the organization may or may not be involved in the process; | this is the option of the law enforcement body and the prosecutors.

In many jurisdictions, law enforcement may request the organization to voluntarily collect or disclose information about the situation to further the investigation and build a case. Typically, the organization may opt to participate or not participate in an investigation when informally requested to do so. Government investigators can seek a court order such as a subpoena to require the organization to produce (deliver to the authorities) evidence, records, or individual employees for interview or deposition. They can also seek a search warrant, which directs law enforcement to enter into the organization's property to find the evidence expressly named in the warrant. In either case, the organization must comply with the request to the fullest extent required. Any interference or negligence on the part of the organization in fulfilling mandated requests may actually constitute additional crimes: obstruction of justice, contempt of court, interfering with an investigation, and so forth.

Conversely, a law enforcement entity conducting a criminal investigation may be severely limited as to which information can be collected and considered and the methods for acquiring that information.

Many jurisdictions have laws constraining law enforcement methodology and reach. The organization's cooperation can often reveal more information than the law enforcement entity would be able to acquire without that cooperation.

Once a criminal investigation has begun, the organization's own policies and procedures are superseded, and the organization's investigative efforts must comply and not interfere with the law enforcement investigation.

Administrative Investigation

An administrative investigation is conducted when the entirety of the process will be contained within the organization; it exists solely as an internal function. When conducting administrative investigations, the organization can follow its own policies and procedures as long as they are in compliance with applicable law(s).

Administrative investigations are usually carried out when an incident is the result of some insider activity (an authorized user acting maliciously or inadvertently, causing damage or bringing risk to the organization) | and when the intended end result is a labor action (some form of punishment issued by the organization itself, such as termination of employment, demotion, warning, etc.). In such cases, the organization is within its legal rights to review and investigate the situation within its own environment.

If, however, in the course of conducting what is originally intended as an administrative investigation, the investigators determine that a criminal action has taken place, the nature and course of the investigation may have to change to reflect this. Depending on the nature of the crime, the organization may or may not have the option of deciding whether to keep the investigation internal or notifying law enforcement.

Example:

The network monitoring unit within the organization notes that one particular user is exceeding normal data usage patterns to a dramatic extent; where most users use the organization's data storage capacity to save, on average, a few hundred megabytes of work data, this user has saved two terabytes of data in violation of normal operating procedures and policy. The security team is informed, and an internal (administrative) investigation begins. The investigators interview the user's manager to determine if there is a unique usage requirement for this user's tasks, or if the user has received special permission to exceed the maximum storage capacity; the manager tells the investigators that the user has no duties that would require this amount of stored data.

Further investigation reveals that the material the user has stored is large amounts of movies and games, intellectual property that the user does not own, and is the property of other parties. This situation has now been revealed to be a crime intellectual property theft - and under the applicable laws in the jurisdiction where the organization operates, it must be reported to law enforcement. The organization no longer has the option to address the matter internally and must formally notify the relevant law enforcement entity.