- Email: [email protected]
Interview with the vampire
FEATURE
Interview with the Vampire James Essinger hat a p p r o a c h s h o u l d you take towards interviewing someone you suspect of using a computer system to defraud your organization? This article gives advise on how to conduct the interview in order to have the best chance of bringing the bloodsucker to justice.
W
Interviewing people who are suspected of having carried out a c o m p u t e r fraud is one of the most challenging tasks which any organization can face. It is, indeed, so challenging that there is a strong case for o r g a n i z a t i o n s not t r y i n g to c a r r y the task out themselves but rather delegating it to professionals. Three such p r o f e s s i o n a l s , w h o s e names and affiliations appear at the end of this article, provided advice for the following discussion of interviewing fraud suspects. All three were firmly of the opinion that the interviewing task is so demanding it should be entrusted to specialists. Very well, they have a vested interest in making that point. However, their argument - - that if amateurs try to undertake interviews there is a serious danger of them damaging the chance of bringing a fraud perpetrator to book - - is a persuasive one. As one of the three said, "Whenever organizations ask us whether they should conduct an interview themselves or allow us to do it for them, we tell them that they should feel free to carry it out themselves if they wish, but that they must understand that if any procedure is not properly followed there is a serious danger not only that any evidence gathered in the interview will be inadmissible in any subsequent court hearing, but also that all the evidence relating to a particular suspect may become inadmissible." Readers of Computer Fraud & Security will, no doubt, be alarmed at the idea of this happening, and also at the prospect of any publicity deriving from a fraud of which they have been the victim. These reasons s u b s t a n t i a l l y explain why private fraud investigation organizations do good business. They
u s u a l l y e m p l o y h i g h - c a l i b r e p e o p l e - - many e x - b a r r i s t e r s and f o r m e r m e m b e r s of the law enforcement services work for them - - and so they can provide a high level of expert, and highly discreet, service. If y o u hire a p r o f e s s i o n a l i n v e s t i g a t i o n organization you can be confident that all the correct procedures will be followed to maximize the chance of a fraudster confessing and also to ensure that his or her e v i d e n c e r e m a i n s f u l l y a d m i s s i b l e in court. Furthermore, fraud investigation professionals are experienced at giving evidence in court, which the interviewer would certainly have to do if the case gets that far. Testifying in a courtroom, especially under the vigorous c r o s s - e x a m i n a t i o n of a skilled d e f e n c e barrister, can be a daunting prospect. Of course, the police are also highly skilled at conducting interviews in the right way and also at giving evidence in court. The difference is that, whereas involving the police is almost i n e v i t a b l y going to lead to the fraud or suspected fraud gaining unwanted publicity, private fraud investigation services pride themselves on their confidentiality. In p r a c t i c e , a b o u t 50% of f r a u d s t e r s find themselves in the courts. Many organizations are perfectly happy with recovering what they can of the funds and dismissing the fraudster. They simply don't want the publicity which taking the matter further would almost certainly involve. On the other hand, if the fraud has been very serious and if external criminals are involved, there may be little alternative to bringing the police in at some point. It is by no means i m p o s s i b l e that persisting in k e e p i n g the affair confidential when dangerous criminals have been active in it may actually involve you in personal danger. This is particularly possible in developing countries where there is little respect for life in the face of the prospect of major illicit financial gain. Of course, there is also the moral argument that if an organization simply dismisses a fraudster without prosecuting him or her, that person may continue their dirty w o r k e l s e w h e r e , p o s s i b l y with r e n e w e d enthusiasm after having seen how they got away with it in one case. Consequently, some organizations are prepared to brave the potential publicity blitz and bring a fraudster to justice.
Computer Fraud & Security August 1998 ISSN: 1361-3723/98/$19.00© 1998 Elsevier Science Ltd. All rights reserved
11
FEATURE My own advice, gathered from talking to fraud investigator professionals on many occasions, is that no organization should, in fact, attempted interviewing suspects itself. The interview process is simply too fraught with potential hazards: you need to leave the job to the experts. Quite apart from anything else, many a m a t e u r i n t e r v i e w e r s are s i m p l y too good-measured to do the job properly. After all, if you are interviewing a suspected fraudster, you are dealing with someone who has very likely taken ingenious steps to steal money from your organization. He or she needs to be dealt with firmly but fairly. You don't want someone doing the job who is used to other types of interaction with personal: such as gently breaking the news that they are being made redundant. Professional fraud investigators have developed extremely good techniques to win confessions from recalcitrant people: I look at some of those techniques below. And w h i l e I do b e l i e v e that the use of professionals is indicated in this particular branch of fraud investigation, there is certainly every reason for readers to know the basics of how a good fraud investigation interview is conducted and how the professionals are likely to go about it. A professional interviewer should have a thorough u n d e r s t a n d i n g of e v e r y t h i n g relating to the investigation and all the technical issues involved in the interview process. The experienced interviewer will be conversant with the rules of libel, privilege, the respective criminal evidence Act for the country in question, and will be familiar with rules relating to self-incrimination, when and how to caution a suspect, the laws governing entrapment and the procedural methods necessary to disprove subsequent accusations about intimidation, coercion, sexual molestation or harassment. All these potential accusations can arise even when a verifiable confession has been made. Professionals also agree that the place where the interview happens is important. Ideally, the suspect should not be interviewed in a setting with which he is too familiar or comfortable: his own office or home for example. While he should not be in a setting which is possibly threatening - - another reason, incidentally, to use professional investigators rather than the police. The best type of venue is a room that is neutral in appearance and which has no distractions.
12
It is important for the interviewer to remember that an interview is, fundamentally, a conversation directed at obtaining information. It is not a cross-examination conducted in a court by a charismatic barrister who will use the force of his p e r s o n a l i t y to make the c r o s s - e x a m i n a t i o n e s p e c i a l l y p e r s u a s i v e . The interviewer should present himself as someone who is genuinely concerned with finding out what exactly has happened. If there are two interviewers they should both have a similar demeanour: there should be no question of amateurs trying to adopt the police technique of having one 'friendly' interviewer and a 'hostile' one. Generally, the professionals advise that only one interviewer is used per interviewee, but there may be occasions where there is a strong case for using another interviewer, especially if the investigation is highly technical. For example, if the fraud was certainly conducted by a computer system, there may be a case for having a computer expert in the interview room. Any more than two i n t e r v i e w e r s s h o u l d definitely be avoided as they would tend to intimidate the s u b j e c t and might well lend w e i g h t to any accusations of intimidation. It's also important to consider the timing of the interview. If the interview throws up evidence which needs to be followed immediately - - and this may well happen - - the last thing you want is for the initial interview to be taking place at five o'clock on a Friday afternoon. First thing on Monday morning is a far more suitable time, providing the flexibility to extend the interview or call the interviewee back during the week. The professionals will almost invariably choose to tape-record the suspect. If the s u s p e c t has been formally cautioned the tape recording must be done overtly. Taking a covert recording of a conversation is a perilous matter as rules of evidence may end up being broken in this way, but in some cases there may be no realistic alternative if you are to have any chance of getting evidence which helps to reveal the truth about what has happened. All tape-recording, whether taken o v e r t l y or c o v e r t l y , s h o u l d of c o u r s e be write-protected and handled in a c c o r d a n c e with evidence rules. Incidentally, you should remember that in some countries, including Switzerland, Germany, Sweden, Belgium, and some states in the United States, covert tape recording is actually illegal.
Computer Fraud & Security August 1998 ISSN: 1361-3723/98/$19.00 © 1998 Elsevier Science Ltd. All rights reserved
FEATURE The b e s t t y p e of i n t e r v i e w e r is one w h o is thoroughly briefed about all the facts of the case - - so that he can ask penetrating questions about any aspect of the case which comes up, rather than having to brief himself again and allow the interviewee some respite. G i v e n that t h e r e is i n d e e d strong e v i d e n c e for believing that the interviewee is in fact guilty of some illicit activity, the interviewer should proceed - - and present h i m s e l f - - as someone who firmly believes in the absolute inevitability that the truth will emerge - whether this takes an hour, the whole day, or several days. Of course, the interview itself must be limited in time if any suggestion of coercion is to be avoided, but the point is that it should be made very clear to the interviewee that you intend to get to the bottom of the matter. The professionals report that the biggest pitfall in any f r a u d i n v e s t i g a t i o n i n t e r v i e w is that the interviewers are inadequately prepared and thus unable to block of denials which the interviewee makes. Many interviewees do in fact go into the interview more or less reconciled to the fact that they will need to confess, but see no reason not to delay the confession for as long as practically possible. Very often there will be one p a r t i c u l a r fact w h i c h the i n t e r v i e w e e continually denies: this is the matter to which a well-prepared interviewer will continually return until the truth is out. Ideally, the method of doing this should not be to 'lead' the interviewee but to ask open questions which oblige the interviewee to provide expansive answers. For example, rather than saying, "After you had lunch you went to the terminal and keyed in your friend's password, didn't you?", it's much better to ask, "And what did you do after you had lunch?" If the i n t e r v i e w e e then p r e s e n t s a story which is completely unbelievable, the way to deal with this is not to say, "I don't believe you" or, even worse, "You're a liar", but rather to return to the matter and tactfully suggest that the interviewee's version of events does not tally with what you know already. For example, you might say, "The problem I have is that your friend John has told us that he gave you his password and has stated categorically that he did not access his terminal himself at the time when the audit trail reveals that the terminal was accessed." Again, the emphasis should be on being polite but
firm and continually making clear that you will get to the truth sooner or later. Another important technique to remember is to keep silent when necessary to build psychological pressure. Do not try to reduce the pressure by breaking a silence yourself. Above all, don't talk too much. The purpose of the interview is to allow the interviewee to do the talking. One professional suggests that an e s p e c i a l l y p o t e n t t e c h n i q u e is to d r a w the interviewee's attention to the fact that a particular question seemed to unsettle them. This can be a good psychological weapon without putting any unfair pressure on the subject. Above all, you should r e m e m b e r that when a subject is lying, he's using lies which have been developed by his imagination. As a result, and because many people do not really have very d e v e l o p e d imagination, the lies will either seem o b v i o u s l y implausible or contain inconsistencies in matters of detail which are absent from a truthful account of r e m e m b e r e d events. Furthermore, if a person is innocent he will usually protest loudly, angrily and vigorously say that he did not do it and be angry about the continual questions. A guilty person will often be far less emphatic or will attempt to evade the issue by saying tangentially relevant things such as, "I can't believe you're asking me this... I've been with this company for a long time out and have an exemplary record." Generally, anything of the, "Do you realise who you're talking to?" school is an almost certain indication of potential guilt. A good interviewer will keep the pressure on r e l e n t l e s s l y . Often, what h a p p e n s is that the interviewee gives up trying to conceal the truth because he becomes aware that it will come out sooner or later and wants to avoid any further humiliation or pressure. Sometimes the confession can come so abruptly and unexpectedly that it may literally take the interviewer by surprise. But that doesn't matter: any confession is a good confession. And confession, after all, is the name of the game. Note: three experts were consulted for the research for this article. These were: Jan Babiak, partner, Ernst & Young; Mark Tantam, partner, Deloitte & Touche; Ed Wilding, Network International.
Computer Fraud & Security August 1998 ISSN: 1361-3723/98/$19.00 © 1998 Elsevier Science Ltd. All rights reserved
13
Interview with the Vampire James Essinger hat a p p r o a c h s h o u l d you take towards interviewing someone you suspect of using a computer system to defraud your organization? This article gives advise on how to conduct the interview in order to have the best chance of bringing the bloodsucker to justice.
W
Interviewing people who are suspected of having carried out a c o m p u t e r fraud is one of the most challenging tasks which any organization can face. It is, indeed, so challenging that there is a strong case for o r g a n i z a t i o n s not t r y i n g to c a r r y the task out themselves but rather delegating it to professionals. Three such p r o f e s s i o n a l s , w h o s e names and affiliations appear at the end of this article, provided advice for the following discussion of interviewing fraud suspects. All three were firmly of the opinion that the interviewing task is so demanding it should be entrusted to specialists. Very well, they have a vested interest in making that point. However, their argument - - that if amateurs try to undertake interviews there is a serious danger of them damaging the chance of bringing a fraud perpetrator to book - - is a persuasive one. As one of the three said, "Whenever organizations ask us whether they should conduct an interview themselves or allow us to do it for them, we tell them that they should feel free to carry it out themselves if they wish, but that they must understand that if any procedure is not properly followed there is a serious danger not only that any evidence gathered in the interview will be inadmissible in any subsequent court hearing, but also that all the evidence relating to a particular suspect may become inadmissible." Readers of Computer Fraud & Security will, no doubt, be alarmed at the idea of this happening, and also at the prospect of any publicity deriving from a fraud of which they have been the victim. These reasons s u b s t a n t i a l l y explain why private fraud investigation organizations do good business. They
u s u a l l y e m p l o y h i g h - c a l i b r e p e o p l e - - many e x - b a r r i s t e r s and f o r m e r m e m b e r s of the law enforcement services work for them - - and so they can provide a high level of expert, and highly discreet, service. If y o u hire a p r o f e s s i o n a l i n v e s t i g a t i o n organization you can be confident that all the correct procedures will be followed to maximize the chance of a fraudster confessing and also to ensure that his or her e v i d e n c e r e m a i n s f u l l y a d m i s s i b l e in court. Furthermore, fraud investigation professionals are experienced at giving evidence in court, which the interviewer would certainly have to do if the case gets that far. Testifying in a courtroom, especially under the vigorous c r o s s - e x a m i n a t i o n of a skilled d e f e n c e barrister, can be a daunting prospect. Of course, the police are also highly skilled at conducting interviews in the right way and also at giving evidence in court. The difference is that, whereas involving the police is almost i n e v i t a b l y going to lead to the fraud or suspected fraud gaining unwanted publicity, private fraud investigation services pride themselves on their confidentiality. In p r a c t i c e , a b o u t 50% of f r a u d s t e r s find themselves in the courts. Many organizations are perfectly happy with recovering what they can of the funds and dismissing the fraudster. They simply don't want the publicity which taking the matter further would almost certainly involve. On the other hand, if the fraud has been very serious and if external criminals are involved, there may be little alternative to bringing the police in at some point. It is by no means i m p o s s i b l e that persisting in k e e p i n g the affair confidential when dangerous criminals have been active in it may actually involve you in personal danger. This is particularly possible in developing countries where there is little respect for life in the face of the prospect of major illicit financial gain. Of course, there is also the moral argument that if an organization simply dismisses a fraudster without prosecuting him or her, that person may continue their dirty w o r k e l s e w h e r e , p o s s i b l y with r e n e w e d enthusiasm after having seen how they got away with it in one case. Consequently, some organizations are prepared to brave the potential publicity blitz and bring a fraudster to justice.
Computer Fraud & Security August 1998 ISSN: 1361-3723/98/$19.00© 1998 Elsevier Science Ltd. All rights reserved
11
FEATURE My own advice, gathered from talking to fraud investigator professionals on many occasions, is that no organization should, in fact, attempted interviewing suspects itself. The interview process is simply too fraught with potential hazards: you need to leave the job to the experts. Quite apart from anything else, many a m a t e u r i n t e r v i e w e r s are s i m p l y too good-measured to do the job properly. After all, if you are interviewing a suspected fraudster, you are dealing with someone who has very likely taken ingenious steps to steal money from your organization. He or she needs to be dealt with firmly but fairly. You don't want someone doing the job who is used to other types of interaction with personal: such as gently breaking the news that they are being made redundant. Professional fraud investigators have developed extremely good techniques to win confessions from recalcitrant people: I look at some of those techniques below. And w h i l e I do b e l i e v e that the use of professionals is indicated in this particular branch of fraud investigation, there is certainly every reason for readers to know the basics of how a good fraud investigation interview is conducted and how the professionals are likely to go about it. A professional interviewer should have a thorough u n d e r s t a n d i n g of e v e r y t h i n g relating to the investigation and all the technical issues involved in the interview process. The experienced interviewer will be conversant with the rules of libel, privilege, the respective criminal evidence Act for the country in question, and will be familiar with rules relating to self-incrimination, when and how to caution a suspect, the laws governing entrapment and the procedural methods necessary to disprove subsequent accusations about intimidation, coercion, sexual molestation or harassment. All these potential accusations can arise even when a verifiable confession has been made. Professionals also agree that the place where the interview happens is important. Ideally, the suspect should not be interviewed in a setting with which he is too familiar or comfortable: his own office or home for example. While he should not be in a setting which is possibly threatening - - another reason, incidentally, to use professional investigators rather than the police. The best type of venue is a room that is neutral in appearance and which has no distractions.
12
It is important for the interviewer to remember that an interview is, fundamentally, a conversation directed at obtaining information. It is not a cross-examination conducted in a court by a charismatic barrister who will use the force of his p e r s o n a l i t y to make the c r o s s - e x a m i n a t i o n e s p e c i a l l y p e r s u a s i v e . The interviewer should present himself as someone who is genuinely concerned with finding out what exactly has happened. If there are two interviewers they should both have a similar demeanour: there should be no question of amateurs trying to adopt the police technique of having one 'friendly' interviewer and a 'hostile' one. Generally, the professionals advise that only one interviewer is used per interviewee, but there may be occasions where there is a strong case for using another interviewer, especially if the investigation is highly technical. For example, if the fraud was certainly conducted by a computer system, there may be a case for having a computer expert in the interview room. Any more than two i n t e r v i e w e r s s h o u l d definitely be avoided as they would tend to intimidate the s u b j e c t and might well lend w e i g h t to any accusations of intimidation. It's also important to consider the timing of the interview. If the interview throws up evidence which needs to be followed immediately - - and this may well happen - - the last thing you want is for the initial interview to be taking place at five o'clock on a Friday afternoon. First thing on Monday morning is a far more suitable time, providing the flexibility to extend the interview or call the interviewee back during the week. The professionals will almost invariably choose to tape-record the suspect. If the s u s p e c t has been formally cautioned the tape recording must be done overtly. Taking a covert recording of a conversation is a perilous matter as rules of evidence may end up being broken in this way, but in some cases there may be no realistic alternative if you are to have any chance of getting evidence which helps to reveal the truth about what has happened. All tape-recording, whether taken o v e r t l y or c o v e r t l y , s h o u l d of c o u r s e be write-protected and handled in a c c o r d a n c e with evidence rules. Incidentally, you should remember that in some countries, including Switzerland, Germany, Sweden, Belgium, and some states in the United States, covert tape recording is actually illegal.
Computer Fraud & Security August 1998 ISSN: 1361-3723/98/$19.00 © 1998 Elsevier Science Ltd. All rights reserved
FEATURE The b e s t t y p e of i n t e r v i e w e r is one w h o is thoroughly briefed about all the facts of the case - - so that he can ask penetrating questions about any aspect of the case which comes up, rather than having to brief himself again and allow the interviewee some respite. G i v e n that t h e r e is i n d e e d strong e v i d e n c e for believing that the interviewee is in fact guilty of some illicit activity, the interviewer should proceed - - and present h i m s e l f - - as someone who firmly believes in the absolute inevitability that the truth will emerge - whether this takes an hour, the whole day, or several days. Of course, the interview itself must be limited in time if any suggestion of coercion is to be avoided, but the point is that it should be made very clear to the interviewee that you intend to get to the bottom of the matter. The professionals report that the biggest pitfall in any f r a u d i n v e s t i g a t i o n i n t e r v i e w is that the interviewers are inadequately prepared and thus unable to block of denials which the interviewee makes. Many interviewees do in fact go into the interview more or less reconciled to the fact that they will need to confess, but see no reason not to delay the confession for as long as practically possible. Very often there will be one p a r t i c u l a r fact w h i c h the i n t e r v i e w e e continually denies: this is the matter to which a well-prepared interviewer will continually return until the truth is out. Ideally, the method of doing this should not be to 'lead' the interviewee but to ask open questions which oblige the interviewee to provide expansive answers. For example, rather than saying, "After you had lunch you went to the terminal and keyed in your friend's password, didn't you?", it's much better to ask, "And what did you do after you had lunch?" If the i n t e r v i e w e e then p r e s e n t s a story which is completely unbelievable, the way to deal with this is not to say, "I don't believe you" or, even worse, "You're a liar", but rather to return to the matter and tactfully suggest that the interviewee's version of events does not tally with what you know already. For example, you might say, "The problem I have is that your friend John has told us that he gave you his password and has stated categorically that he did not access his terminal himself at the time when the audit trail reveals that the terminal was accessed." Again, the emphasis should be on being polite but
firm and continually making clear that you will get to the truth sooner or later. Another important technique to remember is to keep silent when necessary to build psychological pressure. Do not try to reduce the pressure by breaking a silence yourself. Above all, don't talk too much. The purpose of the interview is to allow the interviewee to do the talking. One professional suggests that an e s p e c i a l l y p o t e n t t e c h n i q u e is to d r a w the interviewee's attention to the fact that a particular question seemed to unsettle them. This can be a good psychological weapon without putting any unfair pressure on the subject. Above all, you should r e m e m b e r that when a subject is lying, he's using lies which have been developed by his imagination. As a result, and because many people do not really have very d e v e l o p e d imagination, the lies will either seem o b v i o u s l y implausible or contain inconsistencies in matters of detail which are absent from a truthful account of r e m e m b e r e d events. Furthermore, if a person is innocent he will usually protest loudly, angrily and vigorously say that he did not do it and be angry about the continual questions. A guilty person will often be far less emphatic or will attempt to evade the issue by saying tangentially relevant things such as, "I can't believe you're asking me this... I've been with this company for a long time out and have an exemplary record." Generally, anything of the, "Do you realise who you're talking to?" school is an almost certain indication of potential guilt. A good interviewer will keep the pressure on r e l e n t l e s s l y . Often, what h a p p e n s is that the interviewee gives up trying to conceal the truth because he becomes aware that it will come out sooner or later and wants to avoid any further humiliation or pressure. Sometimes the confession can come so abruptly and unexpectedly that it may literally take the interviewer by surprise. But that doesn't matter: any confession is a good confession. And confession, after all, is the name of the game. Note: three experts were consulted for the research for this article. These were: Jan Babiak, partner, Ernst & Young; Mark Tantam, partner, Deloitte & Touche; Ed Wilding, Network International.
Computer Fraud & Security August 1998 ISSN: 1361-3723/98/$19.00 © 1998 Elsevier Science Ltd. All rights reserved
13