The Investigation Before the Investigation
- SIASS OPERATORS
- Aug 18
- 7 min read
What Should You Do When You Suspect Something Is Wrong?
Suspicion is a starting point, not evidence.
There are many situations where something simply does not feel right.
A business may suspect an employee is passing confidential information to a competitor. A housing provider may know that serious anti-social behaviour is taking place but be unable to establish who is responsible. A private individual may believe they are being followed or monitored. A solicitor may have a client with serious concerns but insufficient evidence to take the matter forward.
In each of these situations, the temptation can be to act immediately.
Start watching. Install a camera. Follow someone. Search their background. Confront the person involved. Collect whatever information you can.
But before an investigation begins, there is often another investigation that needs to happen first.
What exactly are you trying to establish?
Suspicion is not evidence
Having a strong suspicion that something is happening does not necessarily mean you have evidence that it is happening.
That distinction is important.
An investigation should not simply be designed to confirm what someone already believes. A professional investigation should be capable of establishing facts — including facts that may contradict the original suspicion.
For example:
An employer may believe an employee is stealing from the company.
A landlord may believe a particular tenant is responsible for repeated anti-social behaviour.
A business may suspect confidential information is being leaked.
A person may believe that someone is monitoring their movements.
A client may suspect that a partner is behaving dishonestly.
In each case, the initial suspicion may be entirely reasonable.
But the important question is:
What evidence would actually establish what is happening?
That is where professional investigation begins.
Start with the question, not the equipment
One of the most common mistakes in investigative work is starting with the method rather than the objective.
Many of our clients come to us and immediately ask:
"Can you put a camera here?"
Or:
"Can you follow them?"
Or:
"Can you track the vehicle?"
Those may or may not be appropriate solutions.
The better starting point is:
What do we need to establish, and what information would allow us to establish it?
Once that question has been answered, an appropriate investigative strategy can be considered.
Depending on the circumstances, that might involve conventional investigation, intelligence gathering, covert surveillance, technical surveillance, background research, witness enquiries, or a combination of different approaches.
The technology should serve the investigation — not dictate it.
What do you already know?
Before instructing an investigator, it can be useful to establish exactly what information already exists.
What happened?
When did it happen?
Where did it happen?
Who was involved?
What evidence already exists?
Who has witnessed the events?
Are there emails, messages, photographs, CCTV recordings, access records, financial records or other documentation?
Have there been previous incidents?
Are there patterns?
What is fact, and what is assumption?
This process can sometimes reveal that there is considerably more information available than initially realised.
It can also reveal gaps.
And identifying those gaps is extremely valuable.
Preserve what you already have
Evidence can disappear surprisingly quickly.
CCTV systems may overwrite old footage. Digital records can change. Messages can be deleted. Physical evidence can be moved or discarded. Witness recollections can become less precise over time.
If an incident has already occurred, consider what information may exist and whether it should be preserved before it is lost.
This does not necessarily mean collecting everything.
In fact, collecting excessive or irrelevant information can create its own problems.
The objective should be to identify and preserve relevant information that may assist in establishing the facts.
Where an investigation could ultimately lead to legal proceedings, professional advice should be obtained about appropriate evidence preservation and handling.
Don't accidentally compromise your own investigation
Another reason to think before acting is that the actions taken at the beginning of an investigation can affect what happens afterwards.
Confronting a suspected individual may alert them to the investigation.
Changing security arrangements may cause someone to alter their behaviour.
Attempting to conduct surveillance yourself may result in poor-quality evidence — or potentially create legal or safety issues.
Installing a covert device without properly considering the circumstances, permissions, privacy implications and applicable law can create significant problems.
In some investigations, the most useful thing a client can do is not reveal that an investigation is taking place.
This is one of the reasons why professional planning matters.
Intelligence and evidence are not the same thing
Another important distinction is between intelligence and evidence.
Intelligence may provide an indication that something is happening.
It may identify a person, location, relationship, pattern or potential line of enquiry.
Evidence is information that can help establish a fact.
The two are closely connected, but they are not interchangeable.
A piece of information obtained online might suggest that an individual has a connection to a particular company. That may be useful intelligence.
It does not necessarily prove that the individual has committed an offence, breached a contract or disclosed confidential information.
A professional investigation should understand the difference.
The purpose is not simply to accumulate information.
It is to develop reliable information into meaningful findings.
Ask what the evidence needs to demonstrate
Before surveillance or technical investigation begins, it is worth asking what the eventual evidence needs to demonstrate.
For example:
Who?
Who is responsible?
What?
What exactly is happening?
When?
When does it occur?
Where?
Where is the activity taking place?
How?
How is it being carried out?
How often?
Is this an isolated incident or an established pattern?
Why does it matter?
What decision will the evidence ultimately inform?
These questions can dramatically change the way an investigation is planned.
A client may initially believe they need weeks of surveillance when a much more focused operation could answer the relevant question.
Equally, a seemingly straightforward problem may require a combination of investigative techniques.
When covert surveillance may be appropriate
Covert surveillance can be a valuable investigative tool when the objective cannot reasonably be achieved through open enquiries.
It can potentially provide direct observations of behaviour, movements, meetings or activities that would otherwise remain unknown.
However, covert surveillance is not appropriate simply because it is possible.
It needs to have a legitimate purpose and must be planned and conducted within the applicable legal and ethical boundaries.
The circumstances, objective, proportionality, privacy considerations and method of surveillance all matter.
Professional investigators should be able to explain why surveillance is necessary, what it is intended to establish and how it will be conducted lawfully.
When technical surveillance may be appropriate
Some investigations involve more than observing people.
A business may be concerned about unauthorised surveillance within its premises.
A client may suspect that confidential conversations are being compromised.
An organisation may have concerns about covert cameras, tracking devices or other technical means of surveillance.
In these circumstances, technical surveillance expertise may become relevant.
Technical surveillance and Technical Surveillance Counter Measures (TSCM) can form part of a wider investigative strategy where there is a legitimate reason to examine whether technology is being used to obtain information covertly.
Again, the important point is that the technology should follow the investigative requirement.
The presence of sophisticated equipment does not automatically make an investigation better.
Knowing when, where and why to use it is what matters.
Don't investigate the person before investigating the problem
Perhaps the most important principle is this:
Do not start with the person. Start with the problem.
It can be very easy to become focused on a particular suspect.
But an investigation should remain objective.
The question is not:
"How can we prove that this person did it?"
It should be:
"What is actually happening, and what evidence would establish the facts?"
That distinction can protect the integrity of an investigation and prevent assumptions from becoming conclusions.
Sometimes an investigation will confirm the original suspicion.
Sometimes it will reveal something completely different.
And sometimes it will establish that there was no wrongdoing at all.
A professional investigator should be prepared for all three outcomes.
What should you do before instructing an investigator?
If you are considering an investigation, start by writing down what you actually know.
Ask yourself:
What has happened?
What makes me believe something is wrong?
What facts can I already establish?
What information or evidence do I already have?
What remains unknown?
What do I actually need to establish?
What decision will the investigation help me make?
Could taking action now compromise the investigation?
Are there legal, privacy or safeguarding considerations?
What would a successful investigation actually look like?
You do not need to have all the answers before approaching a professional investigator.
In fact, working out the answers can be part of the professional investigative process.
Sometimes the first step is simply a conversation
At SIASS, we understand that clients do not always approach us with a neatly defined investigation.
Sometimes they simply know that something is wrong.
They may have a collection of incidents, concerns or unexplained circumstances but no clear idea of what should happen next.
That is where an initial discussion can be valuable.
The purpose is not to automatically recommend surveillance or technical equipment.
It is to understand the circumstances, establish the investigative objective, identify the information already available and consider what lawful and proportionate options may exist.
Only then can an appropriate investigative strategy be developed.
Because good investigations do not begin with:
“What equipment can we use?”
They begin with:
“What are we trying to establish?”
From suspicion to clarity
An investigation should ultimately move a client from uncertainty towards clarity.
That does not always mean proving that the original suspicion was correct.
It means establishing the facts as far as reasonably possible, using lawful, proportionate and professionally conducted investigative methods.
Sometimes the answer will confirm the concern.
Sometimes it will provide evidence that allows a business, solicitor, landlord or individual to take the next step.
And sometimes the most valuable finding will be that the original suspicion was wrong.
That is still an investigative result.
At SIASS, our role is not to tell clients what they want to hear.
Our role is to establish what we can, lawfully and professionally, and provide the information and evidence needed to help clients make informed decisions.
If you suspect something is wrong but don't know what to do next, the first step may not be an investigation. It may simply be a conversation about what needs to be established.
SIASS – Specialist Intelligence and Security Services
All investigations are planned with consideration given to legality, necessity, proportionality, privacy and the requirements of the individual case.
Suspicion is the starting point. Evidence is the objective.
Comments