1. Information and statement-taking:
2019 Certificate in Forensic Investigation Techniques,
Thursday 29 August 2019

2. Part 1: OBTAINING INFORMATION AND TAKING STATEMENTS

3. INTRODUCTION Overview of the investigative process Information
Intelligence
Interviewing
Questioning
Interrogation
Statements
Conclusion

4. OVERVIEW OF THE INVESTIGATIVE PROCESS
What is Investigation?
Who does investigation?
What powers do investigators have?
What is a Commissioner of Oaths?
Who are Commissioners of Oaths?
What powers do Commissioners of Oaths have?

5. INFORMATION What is information? Where is information to be found?
What is an informant?
How can information be obtained?
How can information be stored?

6. INTELLIGENCE What is intelligence? How is intelligence gathered?
By whom is intelligence gathered?
What is the value of intelligence?
The difference between information and intelligence
How is intelligence recorded?

7. INTERVIEWING Purpose of the interview Points to remember
The interviewer’s attitude
The interviewee’s response
Success or failure
Taking notes

8. QUESTIONING AND INTERROGATION
The essential elements
The difference
The requirements
Points to remember
Attitude

9. STATEMENTS Why take statements The Importance of statements
Preparation
Taking notes
Story-line
Rapport building
Body language

10. ?

11. Part 2: INFORMATION

12. CONTENTS Purpose of Sourcing Information Types of Information
Sources of Information
Public Records, Networks and Associations
Managing Information Sourced
Principles of Lawfulness and Right to Privacy
Protection of Personal Information Legislation

13. “Investigation is both an art and a science; a collaboration of common sense, judgement, intellect, experience, and an innate intuitiveness along with a grasp of relative technical knowledge .”
Charles M Alifano “Fundamentals of Criminal Investigation”

14. THE FRAUDSTER’S MIND
He looks for opportunities to exploit control weaknesses
He repeats his recipe but may change to avoid detection
He creates complex trails to conceal actions
He bamboozles auditors and seniors with creative accounting and his own speak
Personality ranges from MR/Ms Nice GUY to the tyrant you avoid
ALWAYS KNOW YOUR ENEMY
BE PREPARED WHEN YOU CONFRONT HIM= THE IMPORTANCE OF BACKGROUND SEARCHES
1. The importance of knowing your enemy from day 1 cannot be emphasised sufficiently – you want to know what makes him tick; not only how he acted (you will get that from the documents), but WHY – which you will gather from your analysis and deductions of his thinking. Therefore before you even take on the assignment undertake the background searches and find out as much information as possible about the client and the suspects. Be forearmed BEFORE you go in to the meeting. What you have not understood or covered before the meeting can be clarified during the meeting.

15. COUNTERING THE MIND OF THE FRAUDSTER
1.USE YOUR OWN ABILITIES
TO IDENTIFY THE WHAT, HOW
AND SLIP POINTS
2. BE AWARE OF
LEGALITY
TIME
COSTS
As we have already conducted a number of other lectures on investigation you will find that some aspects of the slide are simply included for completeness and I will not engage in any further discussion as you are expected to have this knowledge from the work already covered.
Therefore in this slide I want to focus simply on the fact that much of what investigation is all about is the role you as the investigator has to play to investigate the allegations and issue your findings in the report. So by using your own faculties such as sight, speaking and hearing you will be responsible person for countering the fraudster.
No matter how skilled one is at committing fraud there will always be a slip up and patterns of conduct. It is up to the investigator to find them.
3. Find linkages to prove allegations

16. INFORMATION = knowledge, news and intelligence EVIDENCE = refined
PURPOSE = prove allegations or suspicions in court/disciplinary proceedings
INFORMATION = knowledge,
news and intelligence
EVIDENCE = refined
information.
Sufficient, relevant and
reliable information legally acquired
Experienced with 1 of 5
senses and handed in at
proceedings
INVESTIGATION requires complete and objective evaluation of information and is not based on speculation or conjecture
4W and 1H
FINDINGS substantiated by information sourced
EVIDENCE
Witness testimony
Records and documents
Physical objects
Facts and data

17. SOURCES OF INFORMATION
GOLDEN RULE - SUPPORT EACH REPORT FINDING WITH EVIDENCE . NOT YOUR RESPONSIBILITY TO MAKE A FINDING OF GUILT. BE OBJECTIVE.
Forms::
Witness testimony – interviewing and questioning of independent and accomplice (s204) - primary source
Informants – motive and protection of identity - secondary source
Under cover operatives (Section 252 of Criminal Procedure Act) –costly, time consuming and entrapment – secondary source
Surveillance – person/device – static or moving – disclose existence of cameras on site
Documents, records and exhibits – searches and seizures - law enforcement with/without warrant or consent
Public Record Information
Networks and Associations
1. The objective of an investigation report is to detail your terms of engagement, methodology used and objectively record your findings whether they go for or against your client. It is not your responsibility to make any findings as to the guilt of the parties involved – leave that to the presiding officer.
For each finding contained in your report there must be evidence to support it – either in a witness statement or a document that you will bind into the report.
The slide provides examples of the different sources of information an investigator may rely on. Generally the selection of the source is determined by the information required – therefore if I want formal information as to the academic qualifications and work experience of the suspect I don’t rely on the office gossip but ask for access to the personal file, cv and if a relatively new appointment the information provided at the time of recruitment such as the completed application form.
Friends of the Investigator - When considering potential witnesses don’t under estimate the observation skills of the cleaner and the security officers – the former empties the bins and she sees what goes on in the offices – the latter sees who and what comes and goes day and night – make friends with them – they can be invaluable to proving your case.

18. Different Categories of Access:
ACCESS TO INFORMATION
Different Categories of Access:
Private persons –observe legal parameters
Law enforcement agencies with or without subpoena
includes
banking and telephone records,
interception of electronic communication and records
letters sent via postal services
Restricted to department officials (SARS)
Certain person to whom it was made as in attorney/doctor privilege
Note this aspect was also covered in the Role of a Forensic Investigator. It is included here for completeness in respect of this subject.

19. INFORMATION AGE – OUR GREATEST ASSET
we are blessed to have such quick access to so much information that previously was no so freely available. As an investigator one needs to know how to search for reliable information.
Regrettably not everything you read on the internet is correct – the fake news that Mr Trump frequently refers to is out there. Therefore it is best to treat the information in the same way you would treat any other form of information and subject it to the same triangulation to verify as we discussed in the Rules of Evidence.
The Question Marks on the slide indicate that while there is so much information available the difficulty in an investigation is decideing what is relevant and how best to manage the information, which we will unpack in the next few slides.

20. PUBLIC RECORDS Information developed by and open to the public.
Commercial or Government controlled databases
Credit Bureaus - ITC and Experian Identity Number, Name and
Address Verification
MIE academic qualifications;
Deeds Office property,
Home Affairs – citizenship, marital status dead/alive,
CIPC -company and cc registrations, directors’ names
SARS -Vat and tax registrations,
Department of Social Development -NGOs and PBOs
Business directories,
News media,
Research Articles
BE AWARE OF DEFINITION OF PERSONAL
INFORMATION UNDER POPI

21. MANAGEMENT OF DATA - CREATION OF TIMELINE of individual SPM
Provides overview of info in database
Plots linkages in time
Allows comparison with other time lines
Identifies action triggers
1983 joined
1990 promoted head of dept
1998 first qualified audit report
2009 promoted to head of division
2012 SARS audit
2014 internal audit report rolling cash
From the information recorded on the spreadsheet from my background search (PREVIOUS SLIDE) and the information gathered during interviews and analysing of documents I can create a time line for a suspect/witness which allows me to contextualise actions/events in a timeframe.
These time lines can be created for a number of individuals and then we overlay them to see where there are matches and event triggers.
Why do I do this – it helps to establish what was going on in the life of the suspect which may be the motivators of his actions.

22. Respect mutual confidentiality
PERSONAL NETWORKS
Build good rapport with people you know and trust to provide required information to meet this objective
Respect mutual confidentiality
Keep enlarging and maintaining the network
Listen and compare information given with what you know
SCHOOL/COLLEGE/
VARSITY
PROFESSIONAL ASSOCIATIONS
ACFE, ICFP, IIA, SABRIC, BAC,
SASA
CHURCHES
SPORTS CLUBS
SOCIAL CLUBS
BUSINESS COLLEAGUES

23. HANDLING ORAL INFORMATION
Continuously listen attentively,
Remember and compare new information with what you already know
Look for similarities and
inconsistencies
Build relationships between those
involved and different methodologies used to commit crimes
Gather personal information directly from individual interviewed informing him first why required (POPIA)

24. MANAGING DOCUMENTARY INFORMATION
Don’t just gather– you WILL get bogged down.
RATHER
Identify the type of fraud
Develop a theory of “what was it that happened” - work towards proving or disproving it
Gather widely, analyze closely, review objectively and ruthlessly;
Return what is not required
KEEP THE INVESTIGATION SIMPLE, COMPREHENSIVE AND UNDERSTANDABLE
Be aware of the destruction caused by the shredder and the delete button

25. MANAGING DOCUMENTARY INFORMATION
1. Starting point -chaos
2. Starting to develop some order
3.Filed,
boxed
ready for
Court
Develop logical system for sorting documents
File and number according to report findings
Use dividers and sub-dividers
Evidence to support each step in transaction e.g. daily takings summary, bank deposit slip & bank statement
Do not tamper with or change any document – including punching holes
Secure originals and create working copies
Make soft copies of all documents and store on cd/separate hard-drives

26. BE ALERT TO PHONY DOCUMENTS, OBTAIN AND COMPARE ORIGINALS
Changed details of supplier and client
Genuine

27. ASSET VERIFICATION AND UTILISATION
1. Balance sheet
3. Job Card
4. Driver Allocation Register
5. Security Access Control Register
6. Vehicle Tracking Report
2. Fixed Asset Register ?
Are all assets ACCOUNTED for
VERIFICATION that all used for business purposes

28. ?

29. Communication relates to direct and indirect communication direct is
REGULATION OF INTERCEPTION OF COMMUNICATIONS AND PROVISION OF COMMUNICATION RELATED INFORMATION ACT (NO 7 OF 2000) (RICA)
Section 1 Definition s
Communication relates to direct and indirect communication
direct is
oral communication, other than indirect communication between 2 or more persons which occurs in the immediate presence of all the persons participating in that communication.
Utterance by a person who is participating in an indirect communication if the utterance is audible to another person who at the time that indirect communication occurs is within the immediate presence of the person participating in the indirect communication
Indirect communication
The RICA Act provides a limitation to the Right to privacy by setting out the manner in which the individual’s communication may be intercepted. It is recommended that the student reads the Act in its entirety.
Section 1 contains the definitions and of importance is the one relating to communication.
The key words with direct communication are oral and in the immediate presence of the persons engaged in the conversation.
If we consider the diagram which relates to Subsection ii we see that A and B are within each others immediate presence. B and C are engaged in a conversation on their cell phones (the indirect communication). A can hear what B is saying in her conversation with C. A B
Utterance C

30. b. indirect communication
REGULATION OF INTERCEPTION OF COMMUNICATIONS AND PROVISION OF COMMUNICATION RELATED INFORMATION ACT (NO 7 OF 2000)
b. indirect communication
is the transfer of information, messages or part thereof I the forms of speech, music or other sounds, data, text, visual images (animated or not), signals radio frequency spectrum or a combination of these forms.
2. Definition of Intercept
Acquisition of the contents of communication by:
Monitoring device
Viewing or inspecting the contents of communication
Diverting indirect communication from its intended destination to another destination.
Indirect communication includes telephone calls (land line and cellular); intranet, internet, facsimile facilities, private and personal messages, tracking devices in cars; SMS messages and voic messages.
The Act makes provision for articles sent by postal services.
Interception in short may be defined as the acquisition of the content of communication and make available to third party other than intended recipient.

31. The Act makes provisions for various exceptions such as:
REGULATION OF INTERCEPTION OF COMMUNICATIONS AND PROVISION OF COMMUNICATION RELATED INFORMATION ACT (NO 7 OF 2000)
Section 2
“No person may intentionally intercept or attempt to intercept or authorise or procure any other person to intercept or attempt to intercept at any place in the Republic any communication in the course of its occurrence or transmission.”
Section 4 -9
The Act makes provisions for various exceptions such as:
where the person is a party to the communication;
interception is by any person but a party to the communication has given that person prior written consent;
In the course of business
to prevent serious bodily harm
to establish location in an emergency
Authorized by Other Acts.
distinction between any person and a law enforcement officer
no exception is permitted where the interception is for the purpose of committing an offence
The definition of a law enforcement officer is wider than just a member of the SAPS and includes officers of SANDF, Intelligence Services and IPID.
In the course of business refers to an indirect communication over the telecommunication system may be intercepted if:
The transaction is entered into in the course of that business
Which relates to that business
Which otherwise takes place in the course of carrying out that business.
d. There must be the express or implied consent of the system controller
e. The purpose is the monitoring or keeping record of indirect communication to establish the existence of certain facts to:
Investigating or detecting unauthorised use of the telecommunication system
Undertaken to secure or is an inherent part of the effective operation of the system
(Free calls to support centres that are recorded are excluded)
f. The telecommunications system is used wholly or in part in connection with the business
g. If the system controller made all reasonable efforts to inform the user in advance that indirect communication may be intercepted.
NOTE when one is conducting investigation and wishes to gain access to the indirect communication conveyed over the complainant’s business telecommunication system the investigator is required to demonstrate that all of these aspects have been met, including how the information that the communication may be intercepted was communicated to the users thereof.

32. REGULATION OF INTERCEPTION OF COMMUNICATIONS AND PROVISION OF COMMUNICATION RELATED INFORMATION ACT (NO 7 OF 2000)
Section 6 – Exceptions
relate to business – include where information is required to establish a set of facts
Before you proceed: Ensure client has policy that allows downloading of all information stored on company electronic devices
The definition of a law enforcement officer is wider than just a member of the SAPS and includes officers of SANDF, Intelligence Services and IPID.
In the course of business refers to an indirect communication over the telecommunication system may be intercepted if:
The transaction is entered into in the course of that business
Which relates to that business
Which otherwise takes place in the course of carrying out that business.
d. There must be the express or implied consent of the system controller
e. The purpose is the monitoring or keeping record of indirect communication to establish the existence of certain facts to:
Investigating or detecting unauthorised use of the telecommunication system
Undertaken to secure or is an inherent part of the effective operation of the system
(Free calls to support centres that are recorded are excluded)
f. The telecommunications system is used wholly or in part in connection with the business
g. If the system controller made all reasonable efforts to inform the user in advance that indirect communication may be intercepted.
NOTE when one is conducting investigation and wishes to gain access to the indirect communication conveyed over the complainant’s business telecommunication system the investigator is required to demonstrate that all of these aspects have been met, including how the information that the communication may be intercepted was communicated to the users thereof.

33. REGULATION OF INTERCEPTION OF COMMUNICATIONS AND PROVISION OF COMMUNICATION RELATED INFORMATION ACT (NO 7 OF 2000)
Section 12
No telecommunication service provider may provide real time or archived communication to any person other than the customer.
Section 14 allows for the customer to give written authorisation to the service provider to release specified communication to a named person.
Section 16 relates to the application for and issuing of an interception directive
Applicant as defined in Section 1 – SAPS, SANDF Intelligence Services, Directorate, IPID, Law enforcement agency – authorisation of senior personnel (Maj Gen/ Gen Manager) required.
Made to a Designated Judge
Format of application: includes name, details and location of person’s whose telecommunication to be intercepted; serious offence; other investigation methods have failed to solicit required information or it is too dangerous to use other investigation methods; duration of the interception; no interception applied for previously.
Directive is issued in writing and only valid for three months at a time.

34. PRINCIPLES OF LAWFULNESS AND RIGHT TO PRIVACY
Section 35.5 of Constitution
Evidence obtained in a manner which violates any right should be excluded IF it will render a trail unfair or be detrimental to the administration of justice.
Balance the individual’s legitimate expectation of privacy with what is viewed as objectively reasonable by society
Protea Technology vs Wainer 1997(9) BCLR 1225 (W) -taped conversations of an employee about the affairs of the employer company the employee did not enjoy the constitutional right
S V Kidson 1999 (1) SACR 338 (W) - Interception of a call to which one is a party does not constitute third party monitoring
It appears it is possible to legally record a conversation one
is party to even without the prior consent of the other party.
In the case of Protea Technology the court held that the taped conversations of an employee about the affairs of the employer company the employee did not enjoy the constitutional right.
In the case of S v Kidson the accomplice was given a recording device by the police and taped a conversation with the accused while they discussed the plans to commit a murder. Court held that as the accomplice was a party to the conversation it was not third party monitoring (cannot eaves drop on your own conversation). Third party monitoring occurs when the person recording is not a party to the conversation but is listening from the other side of the room or via a listening device.
The right of the employer to access the business related communications of its employees involves a balance of the right of the individual to privacy and the right of the company employer to remain competitive and efficient. Employees may leak valuable and confidential information to a competitor that causes the employer company to lose a contract potentially worth millions.
The employer owns the equipment that is being used, he also has the say so over how the employee applies himself during his working hours – is he engaged in official duties or busy forging invoices to perpetrate his scam using the company pc and photocopy machine – and therefore is entitled to protect his property and interests and may access the equipment to establish what the employee is up to.

35. LEGISLATION DEALING WITH INFORMATION
PROMOTION OF ACCESS TO INFORMATION ACT (NO 2 OF 2000) (PAIA)
right to access any information held by State or third party required for exercise or protection of any rights
PROTECTION OF PERSONAL INFORMATION ACT (No 4 OF 2013) (POPI)
Every individual is required to take adequate steps to protect his/her own personal information
POPI holds institutions responsible if they abuse or compromise personal information in their possession.
It covers the information of legal entities (data subjects)
Sharing of your personal information requires your consent
Has to be a valid reason for the type and reason for the information gathered
Transparency and accountability on how the information is to be used and notification to owner of information if compromised.
Provide owner of information access to it and the right to delete what is retained
Limit and control access to the information held – required to track those accessing the information and prevent unauthorised access
Required to safeguard the information against theft and compromise
Ensure the integrity of the information at time of capture and that while stored it remains accurate.
This section deals with legislation that relates to the accessing and protection of information:
The Promotion of Access to Information Act gives an individual who is seeking to exercise or protect a right the right to access required information for the state of any party who is holding the required information.
The Protection of Personal Information Act (which we will deal with in more detail) deals with the protection of the personal information held by an institution and gives voice to the enforcement of the Right to Privacy while balancing it against other rights such as the right to access information, while protecting important interests including the free flow of information across South African and its borders. It is recommended that the student reads the Act in its entirety.
The POPI legislation is not unique to South Africa and is found in other countries including the US.
The implementation of the provisions of POPI has had serious implications of the businesses that are holding such information to ensure they comply with the requirements of the legislation. Fines of up to R10 million may be imposed and the data subject has the right to institute civil proceedings against the institution who has abused the data acquired and held. Companies are called on to check their physical security measures, that the data held on the electronic devices is secure – use of passwords or encrypted and that the staff is trained not to unwittingly give out such information

36. PROTECTION OF INFORMATION ACT (No 4 OF 2013)
Section 1 Definitions
Data Subject – the person to whom the personal information relates
Person – natural or juristic
Personal Information – broadly defined includes information relating to:
race, gender, sexual orientation, marital status, age mental health, physical health, pregnancy, disability, religion, culture, language and birth;
academic qualifications, employment history, criminal record, medical history, financial records,
identifying number, telephone, address address,
biometric information,
personal views and opinions,
confidential correspondence,
views about that person as expressed by another.
Section 5 – The Rights of the Data Subject

37. PROTECTION OF INFORMATION ACT (No 4 OF 2013)
Section 6 - Exclusions
Processing of personal information in course of personal or household activity
Where the information has been de-identified to the extent that it can no longer be re-identified (means that the information cannot be linked to a particular data subject)
By a public body in matters dealing with national security, identification of the funding of terrorist related activity, defence or public safety; prevention, detection identification, investigation and prosecution of proceeds of unlawful activities including money laundering
By Cabinet. Its committees and the Executive Council of the provinces
Judicial functioning of a Court.

38. ?

39. THE END