Finding Evidence of Kickbacks Through Email and Messaging Review

Kickbacks, a form of bribery where a portion of an illicit gain is paid back to the person who helped facilitate it, often leave a digital trail. In an increasingly interconnected business environment, electronic communications such as emails, instant messages, and collaborative platform chats serve as critical repositories of information that can reveal the mechanics and participants of such schemes.

Successfully uncovering evidence of kickbacks requires a methodical approach to e-discovery and digital forensics, combining technical expertise with a deep understanding of human behaviour and the specific nuances of bribery and corruption investigations. This practice note details how to navigate the complexities of email and messaging review to identify red flags and concrete proof of illicit payments.

Understanding Kickback Schemes and Digital Footprints

Kickback schemes are typically characterised by undisclosed financial benefits flowing between parties, often in exchange for preferential treatment in business dealings, such as contract awards or product placements. These schemes frequently involve a network of individuals, some directly involved in the illicit payments and others acting as facilitators or beneficiaries.

Digitally, evidence of kickbacks can manifest in various ways:

• Direct communications: Explicit discussions about payments, commissions, or 'favours' in emails or messages.
• Indirect communications: Coded language, vague references to 'fees' or 'arrangements', or discussions that seem out of place given the apparent business context.
• Financial documentation: Discussions about invoicing discrepancies, unusual payment terms, or requests for payments to third parties.
• Relationship indicators: Excessive or inappropriate social interactions, personal requests, or discussions suggesting undue influence or a conflict of interest.
• Anomalies: Unexplained urgency, deviation from standard procurement processes, or unusually quick approvals.

The UK Bribery Act 2010 makes it an offence to offer, promise, give, request, agree to receive, or accept a bribe. Identifying evidence of kickbacks is crucial for demonstrating a breach of this Act and for internal disciplinary actions.

Strategic Collection and Preservation

Before any review commences, proper identification, preservation, and collection of relevant data are paramount. Failure to adhere to these principles can jeopardise the admissibility of evidence or lead to accusations of spoliation, particularly under CPR Part 31 requirements for disclosure.

• Identification: Based on the scope of the investigation, identify all potential custodians and data sources. This includes corporate email accounts (e.g., Exchange, M365, Google Workspace), instant messaging platforms (e.g., Teams, Slack, WhatsApp Business, internal chat systems), and potentially personal devices if corporate policy or consent permits.
• Legal Hold: Implement a legal hold immediately to prevent alteration or deletion of relevant data. Ensure all custodians are formally notified of their preservation obligations.
• Collection: Utilise forensically sound collection methods. For email, this often involves direct collection from mail servers or archival systems. For messaging applications, enterprise-grade tools are necessary to capture data in its native format, including metadata. The ACPO principles for digital evidence provide a foundational framework for ensuring the integrity and authenticity of collected data. Where data resides on personal devices, careful consideration of privacy and proportionality is required, balancing investigative needs with UK GDPR obligations.

Key Review Strategies and Red Flags

Effective review involves a combination of keyword searching, conceptual analytics, and human review. The Disclosure Review Document (DRD) can be adapted to manage and track the review strategy for internal investigations, ensuring consistency and defensibility.

Targeted Keyword Searches

Develop comprehensive keyword lists, including:

• Direct bribery terms: 'kickback', 'bribe', 'commission', 'inducement', 'facilitation payment', 'backhander', 'secret payment'.
• Coded language: Terms known or suspected to be used as code within the organisation or industry (e.g., 'gift', 'bonus', 'special favour', 'consideration', 'arrangement', 'expense account').
• Financial terms: 'invoice', 'payment', 'transfer', 'wire', 'account', 'bank', 'cash', 'discount', 'markup', 'fees'.
• Party names: Names of known or suspected third-party agents, suppliers, customers, and their associated companies.
• Specific project or contract names: If the kickbacks are linked to particular projects.

Employ proximity searching (e.g., 'payment NEAR/5 agent') and Boolean operators to refine results. Iterate on keyword lists as the investigation progresses and new terms are identified.

Conceptual and Predictive Analytics

Leverage technology-assisted review (TAR) tools to identify conceptually similar documents that might not be caught by keywords alone. Train review models using identified exemplars of relevant and non-relevant communications to prioritise documents more likely to contain evidence of kickbacks. This is particularly effective for uncovering subtle forms of communication or instances where specific keywords are deliberately avoided.

Behavioural and Contextual Analysis

Beyond keywords, human review is crucial for identifying behavioural patterns and contextual clues:

• Unusual communication patterns: Senior staff communicating directly with low-level vendor employees, out-of-hours communications, or frequent contact between parties who should not typically interact.
• Inappropriate content: Overly familiar tone, personal requests, or discussions not related to legitimate business.
• Financial inconsistencies: Discussions about payments that deviate from standard procedures, requests for payments to unusual bank accounts or third-party entities, or discrepancies between quoted and paid prices.
• Circumvention of controls: Attempts to bypass procurement processes, accelerate approvals without proper justification, or avoid documentation requirements.
• Redacted or deleted content: While not direct evidence of kickbacks, attempts to redact or delete potentially incriminating communications are strong indicators for further investigation.

Managing Messaging Data

Messaging applications present unique challenges due to their ephemeral nature and informal language. Review platforms must be capable of ingesting and rendering messaging data accurately, preserving message order, participants, and timestamps.

• Short-form communication: Keywords might be abbreviated or contain slang. Be flexible with search terms and consider phonetic searching.
• Context is king: Messages rarely stand alone; review entire conversation threads to understand the full context.
• Emojis and media: Emojis can convey intent or emotion. Images or attachments shared within messaging apps may contain critical information such as invoices or payment details.

Workflow Integration and Reporting

Integrating the findings from email and messaging review into the broader investigation workflow is essential. Document review decisions meticulously to maintain a clear audit trail. When preparing evidence for regulators (e.g., FCA, SFO, CMA) or law enforcement, ensure that all collected and reviewed data is presented clearly, with proper chain of custody documentation. Anonymise or redact personal data not relevant to the investigation in accordance with UK GDPR requirements.

Practical Steps and Checklist for Reviewers

1. Understand the Allegation: Clearly define the alleged kickback scheme, its participants, and timeframe.
2. Define Search Parameters: Create a comprehensive list of keywords and search strings, including direct terms, coded language, and relevant names/entities.
3. Prioritise Custodians: Start with primary suspects and key witnesses; expand as new leads emerge.
4. Utilise Advanced Analytics: Employ conceptual search, clustering, and/or predictive coding to identify patterns and prioritise documents.
5. Focus on Threads: Review entire email and message threads, not just individual communications, to understand context.
6. Identify Financial Anomalies: Look for discussions around unusual payments, invoices, or financial transactions.
7. Document Red Flags: Flag communications that exhibit unusual behaviour, communication patterns, or language.
8. Escalate Findings: Report all potentially relevant findings to the investigation lead promptly.
9. Maintain Detailed Records: Keep a clear audit trail of review decisions, findings, and any redactions.
10. Preserve Chain of Custody: Ensure all evidence identified is handled in a forensically sound manner from collection through to disclosure.

The eDiscovery Workflow and Kickback Investigations

The standard eDiscovery workflow is highly adaptable and crucial for kickback investigations:

• Identification: Pinpoint all potential data sources and custodians involved in or tangential to the alleged kickback scheme. This often extends beyond email to include mobile devices, messaging apps, and enterprise collaboration platforms.
• Preservation: Implement robust legal holds on all identified data. This is critical to prevent spoliation and ensure the integrity of potential evidence.
• Collection: Employ forensically sound collection methods for all electronic communications, ensuring metadata is captured and data integrity is maintained as per ACPO principles.
• Processing: Ingest collected data into an eDiscovery platform, de-duplicate, de-NIST, and apply optical character recognition (OCR) to images to make all content searchable.
• Review: This phase, as detailed above, involves applying search terms, analytics, and human review to identify relevant communications. Reviewers must be attuned to the specific indicators of kickbacks.
• Analysis: Beyond individual document review, analysis involves piecing together the narrative from the relevant communications, identifying relationships, timelines, and the mechanics of the scheme. Visual analytics tools can help map communication networks.
• Disclosure/Production: Present the findings and evidence in a format suitable for the specific context of the investigation, whether for internal reporting, disciplinary action, or submission to regulators or law enforcement, adhering to relevant legal frameworks like CPR Part 31 or the requirements of the SFO.