Corporate Intelligence: Strategic friend or foe?
The UK has one of the fastest growing markets worldwide for companies offering corporate intelligence and investigations services. These services can provide powerful insights for clients, and help to protect against fraud, corruption, litigation, commercial disruption, and reputational damage. But the market for private investigations is largely unregulated. The recent cases of Neil Gerard and Iqbal Khan illustrate the risks that investigators – and those who instruct them – can be exposed to. What legal and practical issues should those instructing a corporate intelligence service keep firmly in mind?
Corporate intelligence covers a broad swathe of activities. It can range from relatively simple open-source enquiries, such as checks on the Companies House website, to targeted surveillance involving multiple “on the ground” operatives. Many such firms are led and run by those who have served in law enforcement and the security services. Lisa Osofsky, current head of the Serious Fraud Office and former FBI lawyer, was until recently Head of Investigations at Exiger, a well-known financial crime consultancy. Prior to her role at Exiger Ms Osofsky worked for Control Risks, another business intelligence group.
The work of corporate intelligence services has recently been under the spotlight in the media. Neil Gerard, Global Head of White Collar Crime and Securities Litigation at Dechert LLP, made the press when he issued a claim against corporate surveillance firm Diligence International for harassment, trespass, and misuse of private information. Mr. Gerard alleges that operatives from Diligence International followed him to work, to a restaurant, and even attempted to track him on a family holiday to a private Caribbean island. It is claimed that two Diligence operatives posing as relatives of Mr Gerard boarded the same plane to St Lucia but were barred from entry to the island, whilst a third operative was intercepted by authorities at the airport. One operative, who accepted that he worked for Diligence, refused to disclose who had instructed his employer.
Another high profile case resulted in Credit Suisse’s chief operating officer resigning after it was discovered that he had instructed a corporate intelligence company, Investigo, to track the bank’s former head of wealth management, Iqbal Khan. Mr Khan had recently left Credit Suisse for a role at rival investment bank UBS, and it was feared that he might take clients with him. Credit Suisse sought to address the resulting scandal by hiring an independent law firm to examine the chain of responsibility and identify who had approved the instruction and observations. The outcome was that Credit Suisse acknowledged that the decision to observe Khan was “was wrong and disproportionate and has resulted in severe reputational damage to the bank”. An unexpected turn in the facts of this case was that the security consultant who acted as a middleman between the bank and Investigo took his own life.
The regulation of surveillance varies according to the activity and who is conducting it. In the absence of specified regulation, intelligence companies maintain that they work within the spirit and guidance set out in the Regulation of Investigatory Powers Act 2000. However, many surveillance activities can amount to criminal conduct, depending on how they are executed. For example, monitoring a person’s phone calls may amount to an offence contrary to section 3 of the Investigatory Powers Act 2016. Of equal importance is the offence of unlawful processing of personal data contrary to section 170 of the Data Protection Act 2018. Data controllers need to consider how they are compliant with the broader provisions of the Data Protection Act 2018 and the GDPR.
Furthermore, the case of Iqbal Khan case illustrates how surveillance which is intended to be covert can lead to physical confrontations between the investigators and the investigated. A claim that Mr Khan and a private investigator had an “altercation” over Mr Khan’s mobile phone is being investigated by Swiss police.
The moral of the story is that those instructing corporate intelligence services and investigators must take a hands-on approach to their own due diligence. What techniques does the investigator use? Is the instructing party satisfied that these techniques are lawful? Could liability in criminal or civil law extend to those instructing? It may help to take a step back and consider what the reputational and legal consequences may be if the surveillance is discovered or goes wrong.
There is little doubt that as international business relations grow, and reliance on digital evidence increases, lawyers see a similar increase in the importance of corporate intelligence services. However, it is crucial when engaging such services that those instructing set out clear expectations and boundaries – and do so in writing. A failure to do so may result in the instructing lawyer ending up in the firing line.