SkarpChapter 2 of 6
Building the Investigation: Governance, Confidentiality, and Evidence Integrity
Students will be able to establish a legally defensible investigation protocol covering team roles, instructions, confidentiality, evidence custody, preservation, and contemporaneous decision records.
1. Start with an Investigation Charter
The charter's purpose
Issue a short investigation charter before the work fragments. It should define the incident, objectives, authority, roles, legal workstreams, evidence controls, and next decision point.
Two kinds of authority
Containment authority and investigation oversight are different. A technical lead may isolate a system immediately, while counsel or an evidence custodian controls how the action is documented and preserved.
Governance is demonstrable
NIS2 management-body oversight and GDPR accountability make governance records important. Neither creates one mandatory investigation template, so the protocol must fit the entity and applicable national law.
2. Example: A Cloud Credential Compromise
Separate containment from conclusions
Disabling a credential may contain one access path without proving what happened earlier. Record the containment action separately from the unresolved questions about access, viewing, copying, alteration, and removal.
Use precise factual language
Say that shipment records were potentially accessible, not that they were exfiltrated, unless evidence supports that conclusion. Precise language preserves credibility and avoids premature legal conclusions.
3. Assign Roles with Decision Rights
Roles need authority
Assign decision rights, not merely job titles. State who can isolate systems, approve service suspension, direct collection, authorize disclosure, and accept residual uncertainty.
Avoid counsel as universal owner
Counsel should control legal analysis and advice, but technical and business owners must own factual records. Separating those functions reduces bottlenecks and avoids confusing advice with evidence.
Make governance observable
A role matrix converts broad governance duties into evidence: named owners, escalation paths, approvals, substitutes, and records showing how important decisions were made.
4. Activity: Build a Decision-Rights Matrix
Complete the matrix
For each action, identify the decider, consultation requirement, evidence needed, and record location. Add a substitute decision-maker for overnight or cross-border operations.
Test reversibility
Ask whether the action is reversible, may destroy evidence, or creates an external commitment. Wiping a host may be necessary, but the preservation decision must be explicit.
5. Control Confidentiality Without Overclaiming Privilege
Labels do not create privilege
A "privileged" label is not self-executing. Analyze national law, lawyer involvement, purpose, recipients, and the communication's substance before relying on protection.
Use three channels
Keep factual records, legal advice, and decision approvals distinct. This improves clarity, limits unnecessary circulation, and avoids presenting ordinary technical evidence as legal advice.
Confidential is not immune
Commercial sensitivity and internal restriction are different from legal privilege. Regulatory information requests require a careful legal basis for withholding or redacting material.
6. Example: Structuring the Forensic Engagement
Define the provider's real role
Ask whether the forensic firm is collecting operational facts, supporting legal advice, or doing both. The engagement and reporting structure should reflect what the firm actually does.
Separate evidence from advice
A technical report should describe sources, methods, limitations, and confidence. A legal memorandum should analyze consequences. Keeping them distinct improves later review.
Use an emergency two-stage contract
If negotiation would delay preservation, authorize immediate collection with a short emergency scope. Complete the fuller statement of work after the first evidence set is secured.
7. Preserve Documents Before Routine Systems Overwrite Them
Preserve before overwrite
Target identity, cloud, endpoint, network, email, ticketing, change, backup, and vendor records before routine deletion or rotation destroys them.
Make the hold operational
A legal hold needs an owner, recipient list, covered systems, suspension of deletion, compliance checks, and refresh points. A message sent without implementation evidence is incomplete.
Be proportionate
Preservation is not an instruction to retain everything forever. Define scope, document exclusions, and expand or narrow the hold as the investigation develops.
8. Establish Evidence Provenance and Custody
The provenance question
For every item, record what was collected, from where, by whom, when, how, and whether it changed. A reviewer should be able to reconstruct the evidence path.
Hashing has limits
A hash supports post-collection integrity. It does not prove that the source was complete, accurate, uncompromised, or correctly interpreted. Record collection limitations separately.
Originals and working copies
Keep originals read-only where feasible. Analyze verified working copies, and document every transfer, transformation, query, export, and access event.
9. Activity: Draft a Fact and Decision Chronology
Two linked timelines
The fact chronology records observable events and sources. The decision chronology records choices, decision-makers, alternatives, available information, and reassessment triggers.
Protect contemporaneity
Do not rewrite decisions with hindsight. Preserve original entries, mark corrections, and explain changes so later reviewers can distinguish contemporaneous judgment from retrospective analysis.
Use confidence labels
Use a shared vocabulary: verified, reported but unverified, working hypothesis, unknown, and disproved. Confidence labels reduce accidental overstatement in reports and meetings.
10. Check Understanding
Check Understanding
Apply the protocol to a situation in which a cloud export shows that sensitive records were accessible, but the available logs do not establish whether the records were downloaded.
Which is the most defensible immediate record?
- Record that the records were potentially accessible, preserve the relevant evidence, identify the uncertainty, and set a reassessment point.
- Record that the records were exfiltrated because accessibility is sufficient to establish a breach.
- Delay all containment and preservation until the investigation proves whether downloading occurred.
Show Answer
Answer: A) Record that the records were potentially accessible, preserve the relevant evidence, identify the uncertainty, and set a reassessment point.
The protocol must preserve evidence and support containment without converting access into proven exfiltration. The record should distinguish verified facts from uncertainty, identify the decision-maker and basis, and specify when the question will be reassessed. GDPR breach analysis depends on the facts and risk, while NIS2 and DORA require structured incident-management and reporting processes rather than unsupported conclusions.
Key Terms
- Legal hold
- A targeted instruction to preserve potentially relevant information and suspend routine deletion or destruction.
- Decision right
- The authority assigned to approve or reject a specified action, including the required consultation and escalation path.
- Fact chronology
- A time-ordered record of observable events supported by identified sources and confidence levels.
- Chain of custody
- The record showing who possessed, transferred, accessed, or changed an evidence item and when.
- Evidence custodian
- The person responsible for evidence registration, secure storage, access control, transfers, and preservation of integrity.
- Working hypothesis
- A provisional explanation used to direct investigation, expressly distinguished from a verified fact.
- Decision chronology
- A time-ordered record of decisions, decision-makers, available information, alternatives, uncertainty, and reassessment triggers.
- Evidence provenance
- The documented history of an evidence item, including its source, collection, handling, transfers, transformations, and integrity checks.
- Privilege limitation
- The principle that confidentiality labels do not automatically create legal privilege; protection depends on applicable law and facts.
- Investigation charter
- A controlled instruction that defines the investigation's purpose, scope, roles, authority, decision points, and recordkeeping requirements.