Evidence, Surveillance & Specialized Investigations

Protecting the Scene and the Evidence

The outcome of an investigation is only as strong as the evidence behind it, and evidence is only as strong as the handling it received from the moment it was discovered. Crime-scene protection is the first priority: establishing a secure perimeter, controlling entry and exit, identifying and separating witnesses, and preventing contamination before evidence is documented and collected. Untrained personnel — including well-meaning employees or managers — routinely destroy evidentiary value by moving items, cleaning up, or allowing unrestricted access before the scene is recorded.

Evidence collection follows a disciplined sequence: photograph and diagram the scene before anything is touched, collect evidence systematically (fragile or perishable items first), mark and package each item individually, and record the collector's identity, date, time, and location for every item at the moment of collection. Physical evidence (documents, tools, damaged property), digital evidence (log files, email, device images), and testimonial evidence (witness statements) each require a different collection method, but all three must feed into the same chain-of-custody log so the case record stays internally consistent.

Chain of Custody

Chain of custody is the chronological, documented record of who collected, controlled, transferred, analyzed, and stored a piece of evidence from the moment it was seized until it is presented in a proceeding or otherwise disposed of. Every transfer of custody must be logged — who released it, who received it, when, and why — with no unexplained gap in the record. A broken or undocumented chain of custody is one of the most common reasons evidence is challenged or excluded, because it opens the door to an argument that the evidence was altered, substituted, or contaminated. The core chain-of-custody elements a CPP must apply are:

Preservation and disposition are also governed by law: evidence relevant to reasonably anticipated litigation is subject to a litigation hold, and destroying or altering it once that duty attaches can constitute spoliation, exposing the organization to adverse legal inference or sanctions.

Surveillance and Counter-Surveillance

Surveillance — the covert or overt observation of a person, place, or activity — supports investigations by corroborating or refuting witness accounts and documenting ongoing misconduct. Modern investigative surveillance increasingly uses unmanned aircraft systems (UAS/drones) and ground robotics, which raise their own legal requirements: in the United States, commercial drone use falls under FAA Part 107, which requires a remote pilot certificate, caps altitude generally at 400 feet, restricts flight over uninvolved people, and does not grant any authority to disable or take down another party's drone. State and local privacy, trespass, and anti-surveillance statutes layer on top of federal airspace rules, so a CPP must clear a planned surveillance operation — aerial or ground-based — against both sets of law before execution. Counter-surveillance detects when the organization itself is being watched or targeted — by a competitor, activist group, or criminal actor — and typically follows a protocol of detect, document, and escalate rather than direct confrontation, since Part 107 gives an organization no legal authority to disable or seize an unfamiliar drone on its own. Ground robotics used for perimeter patrol raise a parallel set of considerations: data-retention limits on recorded footage, notice requirements where employees or the public may be recorded, and integration of robotic sensor logs into the same evidentiary chain as human-collected evidence.

Specialized Crime Categories

The CPP body of knowledge expects familiarity with the major categories of crime a security investigator will encounter, since the investigative approach, evidence type, and referral path differ by category:

• Financial crime and fraud — embezzlement, procurement fraud, expense-account abuse, and financial-statement manipulation; typically requires forensic-accounting support and document-trail analysis
• Intellectual property theft and espionage — theft of trade secrets, proprietary processes, or competitive information, often involving an insider with authorized access
• Property crime — arson, theft, and sabotage against physical assets, facilities, or equipment
• Cybercrime — distributed denial-of-service (DDoS) attacks, phishing, and ransomware, which combine technical evidence (logs, malware artifacts) with the same chain-of-custody discipline applied to physical evidence
• Crimes against persons — workplace violence, human trafficking, and harassment, where victim safety and trauma-informed interviewing take priority over evidence collection speed

Each category may trigger a distinct legal-reporting obligation — for example, suspected trafficking or certain financial crimes can carry mandatory reporting duties — so the investigator must know which categories require immediate escalation to law enforcement or a regulator rather than internal resolution alone. Recognizing the category early shapes the entire investigative plan: who is notified, what evidence must be preserved first, and whether the matter proceeds as an internal case or is handed to outside authorities from the outset.