Using Digital Evidence in UK Bribery Act Investigations

Using Digital Evidence in UK Bribery Act Investigations

Investigations into suspected breaches of the Bribery Act 2010 demand a meticulous and forensically sound approach to evidence handling. Digital evidence forms the cornerstone of most modern bribery inquiries, encompassing communications, transactional records, and system logs. Its proper identification, preservation, collection, and analysis are paramount for establishing facts, determining liability, and ensuring admissibility in regulatory proceedings or criminal prosecutions.

This note provides practical guidance for practitioners navigating the complexities of digital evidence in the context of the Bribery Act 2010, whether for internal investigations, responding to regulatory inquiries, or preparing for litigation. It outlines key considerations and workflow steps consistent with UK legal and forensic standards.

The Bribery Act 2010 and Digital Footprints

The Bribery Act 2010 outlines four primary offences: offering, promising or giving a bribe (Section 1); requesting, agreeing to receive or accepting a bribe (Section 2); bribing a foreign public official (Section 6); and the corporate offence of failing to prevent bribery (Section 7). Each of these offences generates digital footprints that can be critical to an investigation. Examples include:

• Communications: Emails, instant messages (Teams, WhatsApp, Slack), SMS, social media posts, and voice notes. These may contain direct evidence of solicitations, offers, or agreements to make improper payments, or discuss gifts, hospitality, and third-party agent arrangements.
• Financial Records: Accounting software data, bank statements, expense reports, invoices, payment authorisations, and cryptocurrency transaction ledgers. These can evidence payment flows, discrepancies, or unusual expenditures linked to bribery.
• Contractual Documents: Digital copies of contracts, third-party due diligence reports, agent agreements, and procurement documentation. These often reveal the structure of relationships and the terms under which payments were made.
• System Logs and Access Records: Audit trails from enterprise resource planning (ERP) systems, customer relationship management (CRM) systems, network access logs, and door access records. These can pinpoint who accessed what information, when, and from where, establishing patterns of behaviour or unauthorised actions.
• Deleted Data: Even data that has been ostensibly deleted from devices or systems can often be recovered forensically, providing crucial evidence of attempts to conceal illicit activities.

Understanding where these digital artefacts reside and how they are generated is the first step in constructing a robust evidence base for a Bribery Act investigation.

Key Principles of Digital Evidence Handling

Adherence to established forensic principles is non-negotiable when dealing with digital evidence. The ACPO (now NPCC) guidelines for Computer-Based Electronic Evidence remain a foundational framework in the UK for law enforcement and increasingly for internal and regulatory investigations. The core principles include:

• Principle 1: No action taken by law enforcement agencies or their agents should change data held on a computer or storage media which may subsequently be relied upon in court. In practice, this means working on forensic images or copies of data, never directly on original devices where feasible.
• Principle 2: In exceptional circumstances where a person finds it necessary to access original data held on a computer or storage media, that person must be competent to do so and be able to explain their actions and the implications of those actions. This highlights the need for trained specialists.
• Principle 3: An audit trail or other record of all processes applied to computer-based electronic evidence should be created and preserved. An independent third party should be able to examine those processes and achieve the same result. This underscores the importance of clear, comprehensive documentation and repeatability.
• Principle 4: The person in charge of the investigation has overall responsibility for ensuring that the law and these principles are adhered to. This places accountability at the strategic level, requiring oversight of technical processes.

  These principles extend beyond criminal cases and are considered best practice for any investigation where digital evidence may be scrutinised, including civil litigation or regulatory enforcement by bodies such as the SFO, FCA, or CMA.

  Integrating Digital Evidence into the eDiscovery Workflow

  The eDiscovery workflow provides a structured framework for managing digital evidence in Bribery Act investigations. Each phase requires specific considerations:

  Identification

  This phase involves identifying potential sources of electronically stored information (ESI). Beyond standard corporate email and file servers, investigators must consider cloud storage (e.g., SharePoint, Google Drive), collaboration platforms (Teams, Slack), mobile devices (phones, tablets), CCTV footage, IoT devices, backup tapes, and personal devices used for work purposes. Key personnel and custodians, including those potentially implicated and those with knowledge of relevant systems, must be identified.

  Preservation

  Once identified, relevant ESI must be placed under a legal hold. This is a crucial step to prevent spoliation of evidence. It involves notifying custodians, disabling auto-deletion policies, and ensuring IT systems are configured to retain data. For critical devices or systems, forensic imaging should be considered at this stage to capture a bit-for-bit copy of the data in a forensically sound manner, ensuring its integrity and admissibility.

  Collection

  The collection of ESI must be targeted, proportionate, and forensically sound. This often involves using specialised tools to collect data from various sources without altering the originals. For mobile devices, specific techniques are required to extract data from apps like WhatsApp. For corporate systems, remote collection tools can be used to minimise disruption. All collection activities must be meticulously documented, including chain of custody records.

  Processing

  Collected ESI is then processed to make it reviewable. This includes de-duplication, de-NISTing (removing known system files), extracting text from native files, applying optical character recognition (OCR) to image-based documents, and normalising metadata. The goal is to reduce the volume of data while preparing it for efficient review.

  Review and Analysis

  This is where the investigative team examines the processed data for relevance and privilege. Sophisticated eDiscovery platforms facilitate keyword searching, concept searching, threading of email conversations, and the use of technology assisted review (TAR) to identify documents pertinent to the Bribery Act offences. Expert forensic analysis may be required for specific data types, such as reconstructing deleted messages or analysing unusual system logs to uncover patterns of activity related to corrupt practices.

  Disclosure or Production

  Finally, relevant, non-privileged documents are prepared for disclosure to regulators (e.g., SFO, FCA) or for use in legal proceedings. This involves ensuring that documents are produced in a format consistent with requirements, such as those outlined in PD 57AD or CPR Part 31, and that all metadata is preserved as required.

  Practical Steps for Investigation Managers

  Effective management of a Bribery Act investigation requires a structured approach to digital evidence:

  • Establish an Investigation Team: Include legal counsel, forensic IT specialists, and subject matter experts. Clearly define roles and responsibilities from the outset.
  • Scope the Investigation: Define the allegations, timeframes, and key individuals involved. This will inform the initial identification of ESI sources.
  • Implement a Legal Hold: Immediately issue a formal legal hold notice to all relevant custodians, instructing them to preserve all potentially relevant ESI. Follow up to ensure compliance.
  • Engage Forensic Experts: Appoint qualified digital forensic specialists to handle data preservation and collection. Ensure they follow ACPO/NPCC principles and maintain a clear chain of custody.
  • Conduct Targeted Collections: Prioritise high-risk custodians and data sources. Consider staged collections, beginning with primary data sources and expanding as the investigation progresses.
  • Utilise Advanced Review Tools: Employ an eDiscovery platform that supports advanced analytics and efficient document review to handle large volumes of data.
  • Document Everything: Maintain detailed records of every step in the eDiscovery process, from initial scoping and legal hold notifications to collection methodologies, processing steps, and review decisions. This documentation is critical for demonstrating the integrity and admissibility of the evidence.
  • Address Data Privacy: Ensure compliance with UK GDPR when handling personal data, including data minimisation, lawful basis for processing, and appropriate security measures. Consider proportionality when collecting and reviewing data, particularly from personal devices.
  • Prepare for Disclosure: Understand the disclosure obligations relevant to the jurisdiction and regulatory body. Be prepared to articulate the ESI workflow and the integrity of the evidence.

  By following these steps, organisations can build a defensible and robust body of digital evidence, crucial for successfully navigating the complexities of UK Bribery Act investigations.