Here’s to the Entrepreneurs. You’ve Worked Hard to Build Your Business...
Publisher’s Note by Isaac Peck, Publisher
Contributors
Protecting Our Assets by Kelly
E. Riddle, Kelmar Global
Another Residency Investigation Goes Wrong —and Very Public by Isaac
Peck, Publisher
Exploring Every Lead: A ketWork Investigation by Kendra Budd, Editor
COVER STORY: AI and the Investigator: Productivity, Confidentiality, and Discovery by Isaac Peck, Publisher
Why Screenshots Don’t Work as Primary Evidence by Fernando Fernández, Chief Investigator at CIG, LLC
The Insidious Nature of Elder Exploitation Investigations by Kathy Wolfe Brown
Working as a Subcontractor by Catherine Torrez, TBCI
The Narrative Trap: How Confirmation Bias Undermines Legal Due Diligence by J. Alexander Chilton, LPI GA/SC
Mission
Working PI is published to help readers build their businesses, reduce their risk of liability and stay informed on important technology and industry issues.
Write Us at Working PI
Comments and letters are welcome. All stories without attribution are written by the Editor.
6353 El Cajon Blvd., Suite 124-605 San Diego, CA 92115 (888) 347-5273 subscription@workingpimag.com WorkingPIMag.com LinkedIn.com/company/working-pi Facebook.com/workingpi
Working PI is published by OREP Insurance Services, LLC (Calif. Lic. #0K99465) and reaches 25,000+ private investigators nationwide. The ads and specific mention of any proprietary product contained within are a service to readers and do not imply endorsement by Working PI. No claims, representations or guarantees are made or implied by their publication. The contents of this publication may not be reproduced either in whole or in part without written consent.
AI, Society, and the Future
Elon Musk is warning everyone that AI is going to wipe out white collar jobs in the next few years. Dario Amodei, CEO of Anthropic (the company behind Claude), is predicting record GDP growth alongside record unemployment, plus half of all entry-level jobs being gone in the next five years.
AI sure has a lot of people talking, and a lot of people worried. Can I predict the future? Most definitely not. But with that said (wait for it!), here’s my view:
AI is most certainly going to change how business is done and it’s going to change a lot about society. Whether it was the metaverse, NFTs, or now with AI, my bet has consistently been that it will take longer than people think for a new technology to really lead to material changes in how society is functioning.
I tend to agree with Ken Griffin, CEO of Citadel, who said at the World Economic Forum in January: “Data center spending in the United States this year [is] over half a trillion dollars. You’re not going to generate this type of spend, if you’re not going to make a promise that you’re going to fundamentally change the world.”
“Is it hype?” the interviewer asked.
“Of course,” Griffin responded. “How else are you going to get people to write 500 billion dollars of checks just this year alone. There needs to be a level of AI is your savior.”
Interestingly, Griffin softened his skepticism just a few months later at Stanford Business School, pegging AI’s productivity gains in software engineering at a modest 15 to 25 percent while calling high-end research another story: “To be blunt, work that we would usually do with people with master’s and PhDs in finance over the course of weeks or months is being done by AI agents over the course of hours or days.”
From a risk management perspective, courts have now flagged more than 1,400 cases worldwide where attorneys or litigants cited fake AI-generated cases, or cited fake language attributed to real cases—many resulting in sanctions. It’s ironic that lawyers serve as the canary in the coal mine for how AI can get you in legal trouble (literally), but it’s worth considering as we look at how to use AI to be more efficient and better serve our customers.
From a straight practical standpoint, I think a lot of us are still figuring out how exactly AI can fit into our businesses. That’s the topic of this issue’s cover story. It was an honor to sit down with Jay Marin and Chris Reeves from Specialized Investigations Consultants and chat about practical applications for investigators and take a look at what’s to come.
In life and in business, change is one of the constants we can rely on. More of it is no doubt on the way. We’ll do our best to continue reporting on the latest news and technology with the integrity and impartiality that investigators deserve. To your success!
Isaac Peck Publisher of Working PI and President and Senior Broker at OREP Insurance
Catherine Torrez
Catherine Torrez has been a police officer for 20+ years. She attended the Law Enforcement Management Institute of Texas to gain her Management Certificate. She has achieved a Police Instructor Certificate, Mental Health Officer Certificate, and Master Peace Officer Certification during her career. Torrez has worked as a private investigator since 2010 and is now the owner and manager of Stiletto Spy and Company Investigations, LLC. She previously served on TBCI for TALI and is a Certified Investigator in Texas.
J. Alexander (Alex) Chilton
Isaac Peck
Isaac Peck is the Publisher of Working PI magazine and the President
and Senior Broker of OREP.org, a leading provider of E&O insurance for the PI profession. Working PI is the most widely read print magazine for investigators nationwide, reaching over 25,000 PIs. PIs who become OREP Members enjoy two CE courses (15 hours) at no charge (Visit OREP.org/PI-Members for details). Isaac received his master’s degree in accounting at San Diego State University. Email Isaac at isaac@orep.org or call tollfree (888) 347-5273. CA License #4116465.
Alex Chilton is a licensed private investigator in Georgia and South Carolina and Managing Partner at CGA Solutions. Alex has been a licensed private investigator for 26 years and has 11 years’ experience working in law enforcement. Alex has specialized training in Cognitive Interviewing, Forensic Statement Analysis, High Risk Interviews related to Terrorism and Hostage Negotiations. Alex specializes in legal due diligence, business/corporate investigations, and HR investigations. CGA Solutions provides objective, fact-driven investigative services designed to support defensible decision-making in complex matters.
Kendra Budd
Kathy Wolfe Brown
Kelly E. Riddle
Kelly E. Riddle is the President of Kelmar Global Investigations and has more than 40 years of investigative experience. He earned a Bachelor of Science degree in Criminal Justice from the University of North Alabama. He was chosen as the “PI of the Year” by the National Association of Investigative Specialists, while PI Magazine named Mr. Riddle the #1 PI in the U.S. Kelly is the past President of the Texas Association of Licensed Investigators and is on the Florida Association of Private Investigators Advisory Board. He founded the PI Institute of Education in 1989, which provides online learning. Kelly has published 14 books, over 40 articles, and spoken at over 650 events.
Fernando Fernández
Kendra Budd is the Editor of Working PI magazine and the Marketing Coordinator for OREP Insurance, providing liability insurance to over 14,000 professionals in the United States. She is also OREP’s Education Coordinator. In her spare time, Kendra operates as an independent photographer. She graduated with a BA in Theatre and English from Western Washington University, and an MFA in Creative Writing from Full Sail University.
Kathy Wolfe Brown is a licensed PI and coowner of Urban Spy Investigations and former global technology executive with a B.S. in Electrical Engineering Technology and an MBA, specializing in high-stakes investigations involving elder abuse and exploitation, complex fraud, and high-networth divorce matters, using advanced surveillance and digital intelligence to uncover hidden patterns and critical evidence.
Fernando Fernández is a Private Detective, Criminal Investigator for Legal Defense, and Digital Forensic Expert based in Puerto Rico. He specializes in the analysis of digital evidence, including manipulated media, AIgenerated content, and forensic validation of electronic communications. He serves as Chief Investigator at CIG, LLC and was recognized as Investigator of the Year 2025 by the World Association of Detectives (WAD) and International Investigator of the Year 2018 by the Council of International Investigators (CII).
Protecting Our Assets
by Kelly E. Riddle, Kelmar Global
“Large crates are shipped into the U.S., and due to the volume, these peddlers get the items at rock-bottom prices. They then resell them on the streets with little overhead.”
The United States has been a world leader in developing new products and designing everything from purses and apparel to high-end technology. Unfortunately, when you are successful, others want to copy your success. Patent and trademark attorneys go through a complex process to ensure that these trade secrets, logos and merchandise are legally protected. The process seems relatively straightforward and simple. A person or company comes up with a new idea. They pay for research and product development, often utilizing the talents of engineers and other experts. As the product and brand is pushed forward, attorneys file the appropriate legal documents to protect this new business treasure. Along the way, in this seemingly simple process, the brand and merchandise are copied and some of the anticipated profits and return on investment get hijacked. The protection of the trademark, logos and merchandise is becoming an increas -
ingly larger part of the private investigation industry.
Whether sold via the internet or at sidewalk stands on New York’s famous Canal Street, the harm to the U.S. economy from Intellectual Property (IP) theft is substantial. Total losses suffered by U.S. industries due to their products being counterfeited is estimated between $200 and $250 billion per year. Total global losses to United States companies from copyright piracy alone are estimated to be $30-$35 billion, not counting significant losses due to internet piracy. Trafficking in counterfeit merchandise presents economic consequences no less severe. It has been estimated that between five to seven percent of world trade is in counterfeit goods, which is equivalent to approximately $467 billion in global lost sales.
While most countries have some trade in counterfeit goods, some have become
notorious for producing and exporting large quantities of fakes. Information from the customs services of the U.S. and EU Member States provides an insight into which countries are the biggest exporters of fakes and the types of products that are being counterfeited. The top five suppliers of counterfeit goods to the United States were China, Korea, Taipei, Hong Kong and the Philippines. The most common products were media (CDs, DVDs, computer games, etc.), apparel and electronic goods. In total, U.S. Customs seized Intellectual Property Rights (IPR) infringing goods worth $7.3 billion during the fiscal year of 2025.
For private investigators, working closely with all levels of law enforcement is an absolute necessity. It is common to find someone involved in counterfeiting and trademark infringement with tentacles reaching other countries. Since this is a criminal activity, other types of crimipage 8
(1) Key Information: Specific and credible evidence of violation of the South Korea tax laws.
(2) Rewards: 5%-20% of the recovered taxes, up to 4 billion KRW (USD 2.8M), based on your contribution.
v Foreign Financial Account Information Reward Program
(1) Key Information: All available documents, including account holder names, account numbers, and account balances.
(2) Rewards: 5%-15% of the recovered penalties, up to 2 billion KRW (USD 1.4M) For more details, contact: taxkorea@protonmail.com
page 6
nal enterprises are often associated with this element. Depending on the scope of your investigation, you may start off working with local law enforcement and, due to the sheer monetary figures involved you may end up partnering with federal agents. Typically, a private investigator’s client in these types of cases is the company (Gucci, Chanel, etc.) or the law firms that represent these entities. Many times, the private investigator is hired because the company has seen a trend, received an anonymous tip or has developed other information that leads them to believe a specific geographical area is a hot spot for this activity.
The PI is given the task of intelligence gathering to verify these leads or suspicions. Should there be some credibility to the information, the PI will generally reach out to law enforcement and develop a task-force mentality with a game plan to pursue criminal elements.
Before moving forward, the company hiring the PI will usually provide some training materials that outline what a legally registered trademark, logo and product looks like. They will often provide examples and further training regarding common “fakes” or look-alike products and how to quickly distinguish the two. Many of the fakes or “knockoffs” are actually “seconds,” meaning quality control spotted something that caused the item to be rejected as legitimate product. There are an increasing number of knock-off products that are not seconds and are purposely manufactured as a fake.
The economics of knock-off products are plain and simple and are based on the economic principle of supply and demand. As long as consumers keep buying the fake products, then the demand is present. As an investigator, logic will dictate that if you see a product that normally sells for $300 “on sale” for $85, it is probably a knock-off. Companies that develop a clientele following based on the unique characteristics of the product, the higher-than-normal price for similar items also set guidelines for the sale of
their products. These companies provide a suggested retail requirement whereby the retail store can only sell the product within specific dollar amounts. Therefore, seeing products drastically reduced in cost is a red flag for investigators.
The sale of knock-off items is often done at flea markets, discount stores and street vendors. Large crates are shipped into the U.S., and due to the volume, these peddlers get the items at rock-bottom prices. They then resell them on the streets with little overhead.
Preparation should be done in anticipation that you may in fact find some counterfeit items. Based on the value of the items, use a copy machine to copy money and then include the serial numbers of the money in your report. If you are going to an area certain to have some fake items, coordination with law enforcement is essential. Remember that the total dollar amount of the items eventually seized will be one of the factors in whether it is a misdemeanor, felony or comes under the jurisdiction of federal agents. A game plan should be outlined that would include the private investigator being the person to identify the items as counterfeit. Remember, when hired, the company should have supplied you with confidential materials and training to tell the difference between legitimate and fake. Few law enforcement agents have this training available, therefore the PI will be instrumental in determining if the items are in fact knock-offs. The PI will usually be the complainant on behalf of the manufacturer. The PI should have at least one law enforcement officer observing their movements throughout the shopping/ inspection process.
If the PI determines that there are enough fake products to warrant involvement by law enforcement, the PI should discreetly exit the area where a briefing can be conducted with all officers involved. Once it is agreed to move forward, the PI should return to the vendor and purchase at least one item to
document that they are actually selling the products. A minimum of one law enforcement officer should be in position to observe this transaction. Once the purchase of the item is completed, the PI should exit the main entrance of the flea market or store and telephone the detective in charge of the operation.
The detective can then order the team to move in and identify themselves as law enforcement officers to the vendor. The money in the cash register should be reviewed to further prove the purchase was made by matching the money to the money previously recorded. An inventory should then be conducted and the items seized and placed into law enforcement holding. As a side note, be prepared by bringing a box of large garbage bags or cardboard boxes that can be used to package the seized items.
As an investigator, you should walk the aisles of the flea markets acting as an average patron browsing the different tables. When you find a vendor peddling the items you are seeking, inspect the item as you would any other item you were considering purchasing. Things that you can quickly look for include the price to see if it is dramatically lower than it should be, if the stitching is correct, whether there are manufacturer labels, hangtags and related items.
The PI should have working knowledge of the criminal and civil statutes that may be involved in these types of cases. In most cases, criminal charges will be made based on state statutes, but federal laws may come into play based on the circumstances. For instance, in Texas the penal code for if a violation has occurred is if “a person intentionally manufactures, displays, advertises, distributes, offers for sale, sells, or possesses with intent to sell or distribute a counterfeit mark or an item or service that (a) bears or is identified by a counterfeit mark (b) the person knows or should have known bears or is identified by a counterfeit mark.” The statute outlining Trademark Counterfeiting identifies a counterfeit mark as “a
mark that is identical to or substantially indistinguishable from a protected mark the use of which is not authorized by the owner of the protected mark.”
While many state and federal laws are similar, working knowledge is critical to fully utilize the tools available. In addition to criminal statutes, the PI should also understand that the case may have civil ramifications as well. The manufacturer has the right to file civil litigation against the peddlers for economic losses. In most cases there is a distinction made between an “infringement” and a “counterfeit”. The counterfeit product is an absolute violation of the trademark and logo of the company. Simply put, the peddler intentionally copied the logo and used it in an unauthorized manner. An infringement is where they attempted to alter or mislead the buyer by implying that it is original but without copying the logo exactly. This would usually fall under the infringement statutes.
Each brand, logo and trademark is protected to ensure the merchandise
meets the rigid standards set forth by the company. This company or entity, such as the National Football League (NFL), has entered contracts with manufacturers and producers of apparel such as Nike, Reebok, etc. For these companies to utilize the logos, team names and trademarks of the NFL, they pay the NFL pre-arranged fees. The entity (in this case the NFL) must enforce adherence to their trademark and copyrighted materials to ensure companies like Nike and Reebok have a protected product line. Without this enforcement, the licensing fees paid to the NFL would be worthless.
As in other criminal cases, such as drugs, the producer and supplier is what law enforcement officers ultimately try to obtain. If they can get to the supply chain a larger impact can be made on criminal activity. Likewise, if the private investigator can obtain the cooperation of t he vendor to determine where they get their merchandise a sting operation, surveillance and additional investigative techniques can be utilized to catch the larger criminal. Due to the close re-
lationship that is required between law enforcement and private investigators, companies hiring PIs often require the PI to have prior law enforcement experience with good contacts within the law enforcement community.
The bulk of counterfeit merchandise flows into the U.S. through the main ports in New York, Miami, Houston and Los Angeles. In New York, much of the merchandise remains in New York City in large warehouses and is sold in the same area. Although New York is a distribution channel, the other ports pass more of the merchandise into the wider distribution channels. It also stands to reason that the trail of counterfeit merchandise is often tracked back to these areas.
The enforcement of trademarked products, logos and copyrighted material is a growing focus in private investigation. While law enforcement is often brought into the case, law enforcement resources are being pulled in many directions, making the PI’s role even more important.
Examples of poor craftsmanship and stitching
Another Residency Investigation Goes Wrong—and Very Public
by Isaac Peck, Publisher
“District staff are not always equipped to conduct early-morning or discreet verification, and they often prefer not to confront families directly. Hiring a licensed PI solves all those problems, at least on paper.”
This is the tale of how a simple residency investigation turned into an armed private investigator staking out school grounds. And the lessons for PIs are instructive.
What started as a routine residency investigation turned sour when a Del Mar parent noticed an unfamiliar still-running car parked outside her home for several days. A few days later, she realized the same car was following her as she drove her child to school. She called the police. Officers tracked the car to the parking lot of Del Mar Hills Academy, where they found a licensed private investigator behind the wheel with a firearm on him.
The PI had been hired by the Del Mar Union School District to verify whether
the family lived inside district boundaries. He had a valid permit to carry. The problem? California law prohibits firearms on school grounds, even if you have a license to carry.
The Del Mar Union School District wasted no time distancing itself, severing ties with the investigator and sending a letter calling the PI’s behavior “inconsistent with the District’s purpose of maintaining safe, secure, and orderly conduct on all District campuses.” When the nonprofit news site Voice of San Diego published the police report and the district’s letter on May 15, 2026, the story went statewide.
School-district residency surveillance is a growing area of work for PIs nationwide, and the Del Mar case is a window
into how a routine assignment can land on the front page.
Here’s the story.
Response From CALI
The California Association of Licensed Investigators (CALI) issued a measured, professional statement to its members shortly after the Voice of San Diego story broke. CALI’s statement, issued through President Roberto Rivera, neither condemned nor defended the investigator, apart from acknowledging that the article “identifies several facts which, if true, call into question the specific actions of the school district and the private investigator and whether existing laws were followed.”
“CALI, as the long-standing statewide association of licensed private investi-
gators, supports compliance with the laws that apply to the members of our profession who have obtained thousands of hours of training, completed background checks, and passed stateadministered examinations to obtain their licenses,” Rivera wrote, going on to emphasize some of the things PIs do, like finding missing children, catching fraud, and providing essential services to the government.
The CALI President also had something to say about school districts (keeping in mind that nationally, an increasing number of districts are retaining PIs to confirm residency). Rivera noted that school districts are legitimate clients, but that “it is critical that the contractual terms as well as the actual services provided are consistent with the applicable policies, guidelines, and laws.”
Concerning the legal sensitivities raised in the Voice of San Diego reporting, he wrote that “there are laws pertaining to entry onto school grounds, the possession of firearms on school grounds,
the video recordings of minors, and other actions.” The article, he said, “provides a valuable reminder of the sensitivity of investigations and the critical importance of being aware of, and complying with, all statutory and contractual requirements.”
Rivera’s message concluded by stating that CALI would be “closely following the developments in this case and the application of due process to determine the facts and to ensure any deserved accountability.”
School Districts:
A Growing Investigator Clientele
The Del Mar case is one example of how school-district surveillance, a perfectly legal and increasingly common practice, can quickly become public. Residency monitoring has become a growing line of work for private investigators.
It’s a question of basic economics for school administrators. Districts spend
money educating students who don’t actually live within their boundaries. They also face pressure from in-district families who expect fairness in enrollment. District staff are not always equipped to conduct early-morning or discreet verification, and they often prefer not to confront families directly. Hiring a licensed PI solves all those problems, at least on paper.
And so, this is happening all over. Districts from Illinois to Pennsylvania to Ohio are turning to surveillance tools, private investigators, and “patterns of life” data to decide which children belong in their schools. NBC Chicago found districts examining parents’ bank and shopping records and even vehicle-location data to challenge residency. Districts hire PIs to tail parents, monitor morning routines, or discern where a child sleeps. Sometimes the enforcement is seen as unequally
page 12
applied. WHYY in Philadelphia reported that these enforcement efforts disproportionately affect families of color and low-income parents.
California law allows districts to hire investigators for this purpose, and many do. Most cases are uneventful: a few days of observation, documentation of where a student leaves in the morning or returns at night, and a report.
The Sensitivity of Investigating Families and Minors
The Del Mar assignment may have felt routine to the school and the investigator, but schools are among the most sensitive surveillance zones in the country. Unknown adults, unfamiliar vehicles, cameras, and anything resembling “following” behavior trigger immediate concern amongst parents and teachers.
Add a firearm into the mix, even legally carried, and the situation escalates instantly. Public-sector clients also bring public-sector scrutiny, which means investigative journalism becomes a real possibility any time scared parents and irritated police are in the picture.
The Del Mar case is not the only recent example of controversy generated by PIs surveilling families with children. Last year Working PI reported on a case involving high-profile high-school quarterback, KJ Lacey. In that matter, a high-school-football-obsessed Alabama businessman named John Quinnelly Jr. had hired an investigator to gather information Quinnelly believed would out the player as geographically ineligible. That inquiry quickly escalated once the surveillance intersected with a minor who was already a public figure in the high-school sports world. Parents, school officials, and attorneys became involved. The Alabama investigator found himself pulled into a legal and media tangle far larger than the assignment he believed he had accepted, and the matter ultimately spilled into litigation and public scrutiny.
The details here differ. This Del Mar case involves a school district retaining a PI, while the Lacey matter involved
a private citizen as a client. But the underlying dynamic, and the potential for escalation, are similar. Once surveillance touches minors, families, or school-adjacent institutions, the margin for reputational and legal risk narrows quickly. Even lawful investigative work can be perceived as intrusive or threatening, and the investigator can become the public face of a story they never expected to be in.
Following the April incident, the district ended its relationship with the PI firm. In a follow-up letter, student services director Leslie Montoro wrote that the police report revealed the investigator had repeatedly driven onto and parked at the school, something the district had never permitted (although it’s unclear whether there was a prior mutual understanding on this point).
Montoro also wrote that officials were unaware the PI firm’s personnel were armed and had not approved firearms for the assignment. Montoro concluded that the investigator’s actions were incompatible both with state law and with the parameters of the district’s contract.
Residency investigations are low-stakes for the district but high-stakes for the PI if something goes wrong. School environments magnify perceived risk. Parents and staff will report anything that feels unusual, as of course they should.
Where the Communication Gap Opens Up
The Del Mar case shows how quickly a misunderstanding can escalate into police involvement and public scrutiny. The dynamic cuts both ways. The investigator made decisions about parking, firearms, and surveillance positioning that, at minimum, surprised the client. Some of those decisions may also have reflected a lack of clear communication from the district about expectations and boundaries.
From the PI perspective, the gap between school-safety culture and standard surveillance practice is worth trea-
ting as a known operational risk. Any job involving parents and children needs to be handled with the care of a technician working around live wires.
Residency investigations are not inherently problematic. But, like insurance fraud investigations, they are structurally adversarial—one party is looking for evidence of wrongdoing by another party. A standard assignment can become a public story if surveillance is detected, because the very act of investigating is a precursor to eventual confrontation.
If the very setup of the investigation carries that kind of tension, the operational protocols need to be locked down on the front end.
Doing It Right
Private investigators are always free to decline certain areas of work. Some investigators don’t take cases involving children. Some don’t work with government entities and prefer private clients. That’s a legitimate choice.
For PIs who take this work (and there’s plenty of it), CALI and the school district have already pointed out where the trouble usually starts. CALI flagged entry onto school grounds, firearms on school grounds, and video recordings of minors as the legal pressure points. The district’s letter pointed at parking, firearm authorization, and contract scope. In other words, the things that went wrong in Del Mar provide a good map of the questions a PI should be asking when considering any school-district job.
1. Have you treated this as a distinct surveillance category? School environments have their own legal boundaries, cultural expectations, and optics.
2. Has the firearm question been addressed in writing? Assume prohibition unless the client has explicitly stated otherwise. School districts probably don’t contemplate that the investigators they hire will be armed, and any misunderstanding on that point will cost trust on both sides.
3. Have you confirmed in writing whether you can set foot on school property at all?
4. Are your surveillance positions chosen to minimize visibility and avoid any appearance of monitoring children directly?
5. Has the client been walked through what surveillance will actually look like? Timing, positioning, vehicle, what “routine” surveillance entails.
6. Are all instructions and boundaries documented? Have proximity, equipment, hours of operation, and the definition of a complete verification been confirmed?
7. Are communication channels with the client open and active throughout the investigation assignment? Clear communication and shared expectations are the only way to keep
“Residency investigations are not inherently problematic. But, like insurance fraud investigations, they are structurally adversarial— one party is looking for evidence of wrongdoing by another party.”
routine assignments from becoming public incidents.
When you’re working around schools or children, parents and staff will report anything that feels unusual, with a considerably lower threshold for concern than in more adult environments. That’s a feature of the environment, not a failure on the part of the parents.
The Del Mar incident is a useful reminder that residency surveillance, grow-
ing as it is, is a category of work where the operational margin for error is thin. PIs who take it can make it a profitable segment of their business, but only if the protocols on the front end match the sensitivity of the environment.
This is a developing story. Stay up-todate on the latest news in your profession by subscribing to Working PI’s email edition at WorkingPImag.com. Stay safe out there!
Exploring Every Lead: A ketWork Investigation
by Kendra Budd, Editor
“Since the Accused’s glasses had been knocked off previously, he was seemingly unaware that he had even stabbed his brother.”
Law enforcement doesn’t always get it right. Whether due to a lack of collecting all the evidence, not interviewing all witnesses, or a shortage of investigators, the wrong conclusion can be made. That’s what happened with this case.
In March 2024 in the state of Alabama, a man was accused by local law enforcement of manslaughter after stabbing his brother in what was called “a heat of passion” after a physical altercation. However, the Accused* claimed that he only intended to defend himself and their mother who was also present at the time of the dispute. Despite the Mother’s* eyewitness statement, the Accused was arrested and charged with the felony.
The Accused’s attorney, John Beck of beckdefense.com, immediately contac-
ted ketWork Investigations, LLC to examine what actually happened. Working PI sat down with Ketrick Kelley, a former FBI Special Agent and founder of ketWork Investigations to gain his insight into the case at hand, and why it’s important for private investigators to explore every potential lead and never make assumptions.
The Case
On March 24th, 2024, the Decedent* was set to work a double shift at Pizza Parlor*. The Decedent had completed his first shift as normal, but as the night progressed, the Decedent became increasingly erratic and violent. “He had slurred speech. He smelled of alcohol. He began throwing objects,” Kelley explains. In fact, the Decedent had damaged another employee’s car and cut his own hand in
the process—an event that would assist Kelley in his investigation later on.
After his outburst, the Decedent was subsequently fired and asked to leave. According to Kelley, “After he left the restaurant, the female employees were so scared of his actions, they locked and barred the doors.” The manager even called the police because the Decedent had allegedly threatened to return and hurt them.
The Decedent walked to his mother’s apartment, where he and the Accused were residing at the time. After being let in by the Mother, the Decedent went into a violent rage. “He threw his backpack to the ground. He started screaming at his mother about getting fired …,” page 16
Kelley details. Due to this outburst, the Mother and Accused tried to calm him down and get him to leave the unit which instead resulted in a physical altercation between the Decedent and the Accused.
According to both eyewitnesses, the Accused’s “… glasses were knocked off during the unarmed part of the altercation,” Kelley tells us. The Decedent then retrieved a green mop and red broom handle from the foyer’s entry closet and began striking The Accused. In fear, the Accused pulled out a kitchen drawer, spilling the contents on the floor and grabbed a kitchen knife. The Accused “… held the knife out in a defensive posture while stationary as the Decedent aggressed on him with the mop and broom handle,” Kelley says, explaining how the Decedent essentially walked into the knife. Since the Accused’s glasses had been knocked off previously, he was seemingly unaware that he had even stabbed his brother. “He was trying to defend himself,” Kelley explains.
The Mother began applying pressure to the Decedent’s wound and called emergency services, but by then they were too late, and the Decedent wouldn’t survive his injury.
After a brief investigation, the Accused was arrested on charges of Manslaughter, despite the fact that eyewitness testimony argued otherwise. The Arrest Warrant read as such:
CAUSE THE DEATH OF [REDACTED] BY STABBING HIM WITH A KNIFE, WHICH WOULD CONSTITUTE MURDER UNDER 13A-6-2 EXCEPT THAT HE CAUSED THE DEATH OF THE VICTIM DUE TO A SUDDEN HEAT OF PASSION CAUSED BY PROVOCATION RECOGNIZED BY LAW, AND BEFORE TIME FOR THE SAID PASSION TO COOL AND REASON TO REASSERT ITSELF, IN VIOLATION OF 13A-6-3 a2 OF THE CODE OF ALABAMA, A FELONY.
The police investigation had led them to believe that the Accused had killed
the Decedent in a fit of rage, rather than simply trying to defend himself. That’s when ketWork joined the fray.
Decedent’s Violent Background ketWork Investigations was contacted by the Accused’s defense attorney, Beck, whom Kelley had a close working relationship with from years past. Kelley explains, ketWork is “very particular about the criminal defense cases we work,” and Beck knew they would be interested in this one.
The first step for ketWork Investigations is to complete an intake of all parties involved. When they ran a background check on the Accused, they were only able to produce one result: the felony charge in which they were investigating. However, when they ran a background check on the Decedent through Alabama’s AlaCourt for statewide criminal and civil litigation database he had “quite a lengthy criminal history,” says Kelley. The search produced the following results:
• One civil case regarding child support
• Nine drug possession cases
• Four domestic violence cases
• Two traffic violations
This demonstrated that the Decedent had a prior history of violence, and that this incident was only one piece of a growing pattern for him. Next, ketWork conducted interviews with several people who were either involved with the case or had a prior relationship with the Decedent to gain better insight into the event.
Through interviews, ketWork discovered that the Decedent’s violent outbursts may have been triggered by two things. “The Decedent was diagnosed with bipolar disorder and alcohol abuse. He had a history of violent and suicidal tendencies when he drank alcohol,” Kelley informs us. In fact, the Decedent was well known for keeping a Gatorade bottle full of Four Loko at his mother’s residence.
While interviewing the Mother, she was able to turn over a recording from the De-
cedent to herself just nine days before the deadly incident. During said recording, Kelley states that The Decedent was noticeably angry and confesses to “beating his puppy* and breaking out the windows,” of his prior residence. He also admitted in the voicemail to being angry that he could not smoke marijuana, because it calms him down, while alcohol makes him violent.
ketWork was able to recover a receipt from the animal hospital that treated the puppy, confirming that their leg had in fact been broken. They then took their investigation to The Decedent’s prior residence where he had been staying just 48 hours prior to his death. ketWork interviewed his former landlords, who “said that he was unstable and that he punched holes in the walls,” Kelley says. In fact, ketWork took several photos of the damage caused to the home allegedly by the Decedent’s hand. In one of these photos a door can be seen torn nearly in half which was caused by the Decedent during a fit of violent rage. This incident led to him being kicked out of the home.
The former girlfriend of the Decedent, whom he shared a child with, was also interviewed by ketWork Investigations. She was able to corroborate that the Decedent kept a Gatorade bottle full of Four Loko and testified that he had “choked and struck” her on multiple occasions. The domestic violence disputes between the two were well documented in the Decedent’s background check.
According to Kelley, the Decedent had numerous jobs that he had been fired from, so ketWork found it highly important to visit each one of these former jobs. This included subpoenaing their Human Resources departments and interviewing the Decedent’s former coworkers. Several of his former coworkers, “talked about his erratic disposition … one of them had him saved in the phone as ‘Crazy Decedent,’” Kelley discovered. In fact, most of his coworkers said the same thing: that he was physically violent and he’d become agitated easily. His episodes were so page 18
common that each employee had different methods of calming him down, showing the Decedent had a clear propensity toward violence to the point that it needed constant monitoring.
Now that ketWork Investigations had a clear understanding of the Decedent’s background, it was time to establish how it connected to the incident at hand.
Investigating the Incident
In order to have a full picture of the alleged murder of the Decedent, ketWork needed to know exactly what happened leading up to the event. According to one of the pizza parlor employees, the Decedent had asked her to buy him a “Four Loko” during his morning shift—she refused. Then, sometime between the two shifts he walked to a convenience store. When he returned to work, the Decedent was observed drinking a pink colored liquid from a cup by several employees, although no one knew what it exactly was.
The manager of the pizza parlor was able to point ketWork investigators toward the exact location of the convenience store the Decedent had disappeared to. After acquiring the video through a subpoena, ketWork confirmed what they long suspected. “It shows him purchasing a Four Loko beverage,” Kelley states, explaining the alcohol on his breath and pink liquid employees recall seeing him drink. Not only that, but the specific version he was recorded purchasing had an alcohol content of 13.9 percent. “Remember, he’s bipolar, and alcohol makes him extremely violent,” Kelley reminds us. This likely explains the sudden induced rage once he started his second shift.
ketWork was also able to collect text messages sent during the Decedent’s shift between the onsite and regional manager, discussing his sudden erratic behavior. In the recovered text messages, the onsite manager states that she needs to call the regional manager about Decedent’s sudden behavior change, but only once he leaves. One text read, “[Decedent’s] getting blood everywhere,” followed by a photo of what looks to be a pepperoni container. (It is not clear how the Decedent cut his hand, but it’s an important fact to
“After acquiring the video through a subpoena, ketWork confirmed what they long suspected.”
remember for later.) After a couple of minutes, the onsite manager texts the regional manager again saying, “Okay no…he’s being really aggressive now.” The regional manager then responds over 20 minutes later stating that Decedent had been fired.
The recovered text messages also corroborate that the Decedent had damaged another employee’s car. “[Redacted] said he dented her car… with the trash can,” read the text from the onsite manager. ketWork was also able to take images of the employees’ car, which showed that it had been damaged. However, ketWork’s most compelling evidence just comes from right outside of the apartment where the alleged homicide occurred.
Direct Footage
Ring doorbells have become many a private investigator’s saving grace, this case included. Right across from the apartment unit where the incident occurred was another unit that utilized one of these Ring doorbell cameras. Although it could not record directly into the unit, ketWork investigators were still able to gather enough evidence to paint a clearer picture of what occurred that night.
The first noteworthy video clip is at 9:25 p.m., showing the Accused entering the unit and wearing his glasses. According to medical records, the Accused is reported to be legally blind without his glasses. With this information, it becomes clear that the Accused’s story about not realizing he had stabbed his brother due to his poor eyesight could very well be true.
Over an hour later, the Ring footage captures the Decedent attempting to enter the apartment—this occurred just 20 minutes after he was fired. The video shows the Decedent shirtless, carrying a backpack, and showing clear signs of distress. “He’s unsteady on his feet. He’s shaking his head. He appears to be agitated, searching his pockets, presumably for a key,” Kelley details. Then,
he began banging on the door until the Mother let him inside.
Once the door opened, ketWork investigators glean some important details. “There’s nothing notable on the floor. That’s really important,” Kelley explains. It wouldn’t be for another 10 minutes that the door would open again—showing the Mother, hands covered in blood, looking down the hall for the paramedics. With the door now opened, the Ring camera captures a green mop laying on the floor which both the Mother and Accused claimed the Decedent used as a weapon against them. This video now corroborates their story that the mop was in fact “in play,” says Kelley.
At 11 p.m., the police are recorded arriving at the scene and opening the front door, which shows the mop on the floor untouched. Then at 11:05 p.m., medical responders arrive, “and what do we see? Or what don’t we see? The mop is no longer in the entry floor,” Kelley explains. At first, it was assumed that the mop was being collected for evidence, but upon further investigation Kelley discovered that both items, the Accused’s glasses, and the Decedent’s phone were not collected. When asked why he thought these items weren’t gathered, Kelley said, “I don’t think that this was malicious.” Kelley continues, “I just think it was overlooked for whatever reason.” Nevertheless, Kelley knew there were leads that needed further investigation.
Investigating the Scene
On April 4th, 2024, just 10 days after the incident, ketWork investigators photographed the injuries the Accused had sustained during the altercation with the Decedent. In one photo “you can see the hematomas where he was being beaten with the mop handles,” Kelley details. On the following day, investigators conducted a site survey of the alleged crime scene with consent from the Mother.
During the site survey, multiple items were recovered that the police hadn’t thought of collecting themselves. First,
was the Decedent’s cellphone, although not on the scene at the time of police search. The second was his bottle of Oxcarbazepine, which is used to treat bipolar disorder thus confirming his mental health diagnosis. The last notable items were the green mop handle, and the red broom handle which the Decedent allegedly used to beat the Accused. “You could clearly see blood on the red broom handle,” Kelley says. However, what was more noteworthy was that the blood was on the base of the handle, and not the ends. “It was found on the end where maybe somebody had grabbed it … he had cut his hand at work,” Kelley reminds us, showing evidence that it was very likely the Decedent had grabbed the broom that night.
To be sure, the ketWork investigators collected and turned the new evidence over to the police via the DA’s office. The police sent the mop off to a DNA lab to confirm the ketWork investigator’s suspicions. “There were no latent prints found on the evidence that was submitted. However, we got word from the DA’s office that the blood smears … exclu-
sively matched with the Decedent,” Kelley says. This physical evidence combined with the photographic evidence of the Accused’s injuries, two eyewitness testimonies, and the Decedent’s violent history validated the Accused’s claim of self-defense. As a result of this independent ketWork investigation, attorney Beck felt they had enough to submit their findings to the DA’s office, to reconsider the charge against the Accused.
Conclusion
Typically in defense investigations, ketWork combines the Police investigation (post discovery) with their own investigation. However, this time around they solely relied on their own investigation. “We decided the evidence was so strong in our favor, that we’d go ahead … and submit it,” says Kelley. However, in December of 2025, as Kelley was preparing for the case to go to trial, they got word that the case had been sent to Grand Jury, and it was deemed “no billed.” Meaning, the Grand Jury had found a staggering lack of evidence of a crime on the prosecutor’s side to pro -
ceed with a trial, and the Accused had been cleared of any wrongdoing.
Despite that the case never went to trial, there is an important lesson to be learned here: to treat every case as if it will go to trial. That is what ketWork Investigations did. Together, their team was able to compile a 25-page Mitigation Report, detailing their comprehensive and independent investigation. It would have been difficult for the prosecution to make a case of manslaughter against the Accused due to the preparedness of ketWork. “We were proud of it,” Kelley says. That’s what every private investigator should be aiming for—to be proud of their work and try their best to ensure that justice is served.
ketWork.com is an Alabama-based investigative firm, also licensed in Louisiana. ketWork recently opened a franchise in Arkansas, ketWork.com /hill , owned and operated by retired FBI Special Agent Tonja Hill.
*Names redacted for privacy.
AI AND THE INVESTIGATOR: Productivity, Confidentiality, and Discovery
by Isaac Peck, Publisher
“Marin described the familiar problem of sitting down at eight or nine at night to write up work done at two in the afternoon, then finishing at one or two in the morning.”
The courts are already starting to ask expert witnesses a question most PIs have not yet asked themselves: what exactly are you typing into ChatGPT?
On May 18, 2026, a federal magistrate judge in Connecticut ordered an expert witness to hand over her AI prompts to opposing counsel in a major environmental case. The ruling does not directly govern most PI work, but it signals where courts are heading, and it puts a new layer on every conversation about how investigators use AI in their work.
The PI profession is well past the point of debating whether to use AI. When Working PI hosted a webinar on artificial intelligence for private investigators earlier this year, the live audience answered a poll question before the presentation began: are you using AI tools today? 73 percent said yes. That is up
dramatically from just 21 percent who answered affirmatively in the Working PI Nationwide Private Investigator Survey run a year prior in early 2025.
The real questions now are practical. How can investigators use AI to be more productive and efficient in their businesses, all without creating confidentiality exposure, getting blindsided in discovery, or losing the trust of the attorneys and clients who hired them?
Here’s what PIs need to know right now.
How PIs Are Actually Using AI
In May 2026, Working PI hosted a webinar, AI for Private Investigators: A Practical Starting Point , featuring Jay Marin and Chris Reeves, two PIs who are actively integrating AI into their PI work (To view the full webinar, visit WorkingPImag.com/AIwebinar). Over
700 PIs registered for the webinar and nearly 350 showed up live to the event. Jay Marin is the President and CEO of Specialized Investigations Consultants, a Florida firm with offices in Miami, Lakeland, and Naples. And Marin’s director, Chris Reeves, spent a decade in the U.S. Air Force and another decade in cybersecurity before transitioning into investigations.
Marin and Reeves offered up a variety of concrete use cases for attendees. Report writing is the first one most investigators recognize. Marin described the familiar problem of sitting down at eight or nine at night to write up work done at two in the afternoon, then finishing at one or two in the morning. With the right setup, he says, that same report can be drafted in twenty or thirty minutes.
page 22
“AI is not replacing the investigation. They need us for that,” Marin says. “We need a body, a person, a being there. But everything that surrounds the job and the investigation, that’s where AI helps.”
Marin pointed out that for most PI businesses, the time burden of administrative work scales with the size of the operation. The smaller the shop, the more the owner is also the report writer, the email responder, the invoice generator, and the case manager. “When we all started and it was just one or two of us, that was very cumbersome,” Marin says. “We would always be busy trying to get out the work product and then actually conducting the field work as well.”
Reeves walked attendees through their actual workflow. The firm uses Claude for much of their work. “Claude is a much more robust system,” Reeves explains. “To run our business and to use it in our field of investigation, Claude has a lot more features than [other mainstream models].” He builds workflows inside Claude projects, where templates, reporting standards, and case-specific instructions all live in one place. The system knows what kind of report he is writing based on the project, and it produces what he describes as a 90 percent draft in two or three minutes.
Here’s the catch: Reeves isn’t saying AI is doing 90 percent of the work. He’s using AI to help write up investigations he’s already done the work on. By the time Reeves asks AI to help, he’s already done the relationship mapping, fact verification, contradiction analysis, and more. He plugs his structured notes into the tool and it produces a draft in the firm’s format and tone. “It’s not like Claude is doing any research and then taking that and throwing that into a report,” Reeves says. “It’s everything that I’ve done. I’m just using Claude to write it out and summarize it.”
For research and OSINT work, the use case shifts. Reeves uploads documents (public records, business filings, corporate registries) and asks the system to summarize, cross-reference, or flag
“Here’s the catch: Reeves isn’t saying AI is doing 90 percent of the work. He’s using AI to help write up investigations he’s already done the work on.”
inconsistencies. He gives the model role-specific instructions on the front end. “I want you to operate as an expert OSINT analyst” is a typical instruction. He tells the model to cite its sources, identify which document and page each finding comes from, and refuse to fabricate or infer beyond what the source material supports.
Marin added that the instructions can go further, specifying the legal and regulatory framework the investigator operates under. “You can tell it, hey, I want you to operate as an investigator compliant with Florida Chapter 493 standards,” Marin says. “That way, anything that is getting pulled or researched is complying with the rules and regulations of what governs us here in the state of Florida for our profession.”
For client communication, the use case is more straightforward. A long surveillance day ends with a frustrated client asking for an update. The investigator knows what to say but does not want to spend twenty minutes finding the right tone. The model drafts an email in two versions, one warm and one firm, and the investigator picks and edits.
Document review is another area where AI can be particularly useful. Reeves describes uploading a forty-page investigative report and asking the model for a structured summary that returned in under two minutes. “These days in 2026, you really don’t need to be sitting there reading that and spending all that time reading that,” Reeves says. The summary becomes a starting point, not a substitute for review, but the time savings on long, dense documents is substantial.
Of course, many investigators are already using AI to draft reports and summarize documents. However, Marin and
Reeves have a unique infrastructure and subscription plan that ensures the confidentiality of their data is protected. Marin and Reeves run Claude on an enterprise plan, and they also operate a server in a private data center with over 700 gigabytes of RAM and dedicated GPU cards, which lets them run AI models entirely on hardware they own.
“If you have your own [local model], it’ll help you make sure that all your personal information is kept,” Reeves says. “Nobody’s information is getting uploaded and sent out there.”
This setup points to an exposure most PIs aren’t thinking about but should be: confidentiality.
Confidentiality is Complicated
Confidentiality has emerged as a key concern not only for PIs, but for professionals everywhere whose work carries contractual or professional duties of client privacy. Most public AI tools, especially the free chatbots most people use, handle data very differently from enterprise systems.
When a user types information into a free ChatGPT account, that input is potentially used to train future versions of the model and is retained on the provider’s servers under terms most users never read. The Claude Pro tier at $20 per month allows users to toggle off data sharing, but that protection is a setting, not a contractual guarantee. Real contractual protections (no training on inputs, no retention beyond defined windows, audit rights) kick in at the team and enterprise tiers, where pricing starts at $100 per month minimum.
For a PI working a routine background check, those distinctions may not mat-
page 24
TALI ‘26 has one theme, and one mission: Technology-Driven Investigations.
The PI profession is evolving faster than ever. The investigators who thrive are the ones who understand digital evidence, leverage open-source intelligence, navigate AI tools responsibly, and stay ahead of the technology that bad actors use to hide.
This September, 14 sessions will cover exactly that — taught by nationally recognized experts who practice what they teach.
TOPICS INCLUDE:
• Decoy app detection and vault app forensics
• OSINT for modern investigators
• Cybersecurity for PI firms
• IoT devices as digital evidence
• Forensic genetic genealogy
• TSCM and modern surveillance threats
• Event Data Recorder investigations
• International digital investigations
• And more
September 24-26, 2026
The Monarch San Antonio
page 22
ter much. For a PI working under attorney direction on active litigation, they matter enormously.
The legal exposure is direct. In U.S. v. Heppner (S.D.N.Y. 2026), a federal court held that communications with a public AI chatbot are not communications with an attorney. The defendant in that case used a consumer (not commercial) chatbot account to ask legal questions. Law enforcement later seized the defendant’s electronics and sought that information. The defendant claimed both attorney-client privilege and work-product protection. The court rejected both arguments, pointing to the platform’s privacy policy, which made clear that input data could be used for training and shared with third parties. By using the public service, the defendant had voluntarily disclosed the information to a nonconfidential party. No privilege attached.
Imagine an investigator working a defense case feeds case details into a free (or contractually unprotected, lower tier) ChatGPT account to brainstorm investigative angles. Without the right subscription and contractual protections, that confidential information now lives on someone else’s servers. Even if the PI strips names and tells himself he has been careful, a stripped prompt can still give the case away.
The PI now has two problems. The first is contractual. Most PI engagement agreements with law firms include confidentiality clauses prohibiting disclosure of case information to third parties without authorization. Feeding case details into a public AI tool is a third-party disclosure. The PI may be in breach of contract before opposing counsel ever finds out.
The second is work-product doctrine. For PIs working under attorney direction, work-product doctrine is the main legal shield protecting investigative materials from discovery. That protection can be waived by voluntary disclosure to a third party outside the attorney’s circle of confidentiality. A free chatbot
“A free chatbot is exactly such a third party. In other words, a PI who uses an AI tool without proper contractual protections may be waiving work-product protection on all of the work the
is exactly such a third party. In other words, a PI who uses an AI tool without proper contractual protections may be waiving work-product protection on all of the work the tool touched. Once the protection is waived, opposing counsel has a path to the prompts and outputs; they can subpoena the provider, compel the PI to produce them in discovery, or use them at deposition.
Marin has thought about this directly. “Who knows what’s really going to happen down the road?” Marin asks. “That’s why for us, we’ve kind of pushed a local large language model and have our own local model so we can keep our stuff internal.” His concern is not just about today’s terms of service, but what might happen to his firm’s data in the future. For example, what happens if ChatGPT or Claude is acquired, changes its policies, or eventually monetizes its archive of user inputs in ways the original users never anticipated.
Those concerns are one of the main reasons that Marin and Reeves are investing in enterprise tools and a local server in a private data center. They want primary control over their data to avoid any confidentiality breaches or work-product challenges.
Expert Witness Ruling
The most significant recent development in this area is Conservation Law Foundation v. Shell Oil Co., decided May 18, 2026, by Magistrate Judge Thomas O. Farrish in the District of Connecticut.
The plaintiff’s expert witness, Dr. Naomi Oreskes, a Harvard historian of science, used AI prompts to help narrow Shell’s massive document production into the subset she relied on for her expert report. The defendants moved to compel production of those prompts as part of expert
discovery. The plaintiff resisted, arguing first that AI prompts were not part of an expert’s methodology, and second that a Rule 29 agreement between the parties protected the prompts as “notes.”
Judge Farrish rejected both arguments. On the methodology question, he wrote that “the process by which Dr. Oreskes culled down the defendants’ document production into a subset to be worked with is an aspect of that methodology.” On the Rule 29 question, he held that a generic agreement to withhold “expert notes” was not “quite clear” enough to cover AI prompts specifically. The plaintiff was ordered to produce the prompts.
To be clear, most PIs do not appear in courtrooms to testify as expert witnesses. Thankfully, when PIs work as defense investigators or as consulting, non-testifying experts under attorney direction, they fall under a different framework. The Supreme Court’s 1975 decision in U.S. v. Nobles established that investigative work performed by a defense investigator can qualify as attorney work product, with strong protection against disclosure. The current Federal Rules of Civil Procedure preserve that strong protection for consulting experts under Rule 26(b)(4)(D), which generally shields their work absent “exceptional circumstances.”
This makes it all the more important that PIs operating under the work-product doctrine use contractually tight and confidential versions of AI, so as to avoid voluntary disclosure to third parties— which can void work-product confidentiality protections.
However, for PIs who do testify as experts, or who work closely with the experts who do, this is a clear signal that
tool touched.” page 26
your AI use is going to be examined the same way your other investigative tools are. The era of treating AI as a backof-house productivity tool, invisible to the case file, is closing. Document your AI workflow as carefully as you would any other part of your investigation, talk with retaining counsel about how the work was done, and make disciplined choices about what tools to use for what kind of case.
This last ruling is one of the first federal decisions on AI in expert discovery, and of course it won’t be the last. So far, it seems likely that courts will treat AI use like any other piece of investigative work: protected as work product when it’s handled correctly, but exposed in discovery when those protections are waived or when the investigator testifies as an expert.
The Insurance Angle
As PIs adopt AI tools, liability is an important part of the conversation. As a national provider of liability insurance for more than 14,000 professionals, OREP sees firsthand how new technologies can translate into real-world claims. Bryan Crosco, Senior Underwriter at OREP Insurance, says verification is non-negotiable when it comes to AI. “AI can help a PI work faster, but it can also make it easier to miss errors if investigators assume the technology is always right. If you’re using AI to draft sections of your reports or summarize case documents, doublechecking it is mandatory,” Crosco says. “From a liability standpoint, the PI is still on the hook, regardless of how the information was produced.”
The confidentiality piece is just as important. PIs handle some of the most sensitive information in the marketplace, including private financial records, medical information, surveillance footage, witness identities, and case theories developed under attorney direction. A confidentiality breach, even an accidental one, can expose a PI to a lawsuit from their client, a complaint to their state licensing board, and a discovery fight in the underlying case the PI was hired
to support. “Confidentiality isn’t just an ethical obligation, it’s a contractual one,” Crosco says. “When a PI types case details into an AI tool that doesn’t have the proper protections, they may be in breach of their engagement agreement before the work is even finished.”
For PIs carrying combined General Liability and Errors & Omissions coverage, the professional liability piece is what responds when an AI-related error in a report becomes the subject of a claim. However, Cyber insurance is becoming more important than ever given how much PIs are relying on technology. Cyber coverage is what responds if a PI faces a data breach, is hacked, or has a system outage that materially affects their business. OREP recommends $1 million in Cyber Liability coverage for PIs handling sensitive client data, though for PIs on a tighter budget, a $100,000 Cyber Liability policy is available for $125 per year.
Building Guardrails
For PIs who want to use AI productively without creating new risk, the practical guidance is straightforward. Start with the right tool. Free, public AI tools should be out of bounds for any work tied to a client matter. The convenience is not worth the disclosure. If the use is genuinely confidential (case facts, witness names, investigative theories, attorney strategy), the tool needs to provide contractual protection, not just a settings toggle. That means a Teams or Enterprise account with documented no-training and no-retention contract terms, or a locally deployed model that runs entirely on hardware your firm controls.
From there, protocols. Marin and Reeves moved AI from an experiment to a formal part of their operations. “The same way that we have standard intake processes and a standard surveillance log, we have a standard AI workflow,” Marin says. Marin’s firm has built repeatable workflows in the four areas where AI saves them the most time, and they specify context, format, and role in every prompt rather than asking the AI for open-ended help.
Before you trust a tool with real client work, test it on fake cases. Both Marin and Reeves run new tools through fictionalized files before putting any real case in front of them. Build a fake case file with fake names, dates, and details. Run it through the AI tool the way you would a real case. See where the tool helps and where it misfires. This lets investigators understand the capabilities and limits of a particular system without ever putting privileged information at risk.
Lastly, verification and review are key. “You still have to verify and review,” Marin says. “It’s a lot easier to review it and make sure it’s right than to do everything from beginning to end.”
Where This Goes From Here
Given how widely PIs are now using AI, the question is no longer whether AI can be useful in a PI’s business, but how PIs can use it effectively and safely, given the confidentiality and discovery concerns emerging in the courts. The May 18 ruling is the first of what will likely be many federal decisions addressing AI in litigation work, and the contours of work product protection in an AI-enabled practice will be worked out in courts over the next several years.
Yes, AI can make PIs more efficient, and the use cases for it are likely to increase. But as Marin and Reeves both pointed out, AI does not replace the investigation itself. It’s up to the PI to verify, check sources, and to bear professional responsibility for what ends up in the final report.
These are exciting times to be an investigator and the tools available to investigators are rapidly changing. The profession has been through technological shifts before, from the typewriter to the database, from the camera to GPS, and PIs who adapt thoughtfully always come out ahead.
This is a developing story. Stay up-todate on the latest news in your profession by subscribing to Working PI’s email edition at WorkingPImag.com. Stay safe out there!
Take Your Business to the Next Level Toolkit for Professional Investigators
Hone New Skills Expand Your Business Increase Your Income 1 2 3
OREP is more than just another Insurance Agency As an OREP Member, you get access to an unrivaled training suite of products to help you build your skills and grow your business (at no additional cost).
Learn from the Best Training, eBooks, and Contracts from experienced attorneys and industry-leading private investigators (Kelly Riddle and Mark and Wendy Murnan).
The Art of Surveillance
Conducting surveillance correctly is truly an art. This eBook shows you how to avoid common mistakes, use proper equipment and different concealment techniques; includes a section on international investigations.
Secrets of a PI Agency:
Marketing and Management
Good investigation techniques will only get you so far. Learn from one of the leading investigators in the nation on how to grow your agency like any other business by utilizing savvy marketing techniques and business skills.
Marketing to Plaintiff Attorneys
Learn valuable strategies and techniques for marketing your agency to plaintiff attorneys! Many PIs ignore this high-value niche that pays higher hourly rates.
Subcontractor Manual
Step up your game when it comes to dealing with subcontractors. Set clear expectations on how subcontractors should handle confidential information, interact with clients, and navigate insurance requirements.
Things They Didn’t Tell You (About Starting a PI Business)
Why struggle to get your business up and running when you can rely on the experience of someone who has been in business for more than 40 years? This book is a road map for anyone serious about starting a PI business.
Investigator Procedures Manual
Shorten the learning curve and increase your own (or your new hire’s) productivity, as well as your agency’s profits! This pre-formatted procedure template helps you build business processes for success.
Business Plan Template
Use this as a template for the growth of your PI business. Kelly E. Riddle shows you how to set your services apart from others, define what market you serve, the types of services you provide, how you will market the business, its financial history, business expansion, and more.
8 Hour CE Class: “Surveillance Strategies for Success”
Learn key strategies and tips to successfully execute surveillance operations as a private investigator.
Engagement Letter
Enjoy a templated Engagement Contract prepared by an attorney and former FBI agent.
Subcontractor Agreement
Prepared by an attorney and former FBI agent.
Why Screenshots Don’t Work as Primary Digital Evidence
by Fernando Fernández, Chief Investigator at CIG, LLC
“Digital evidence, by definition, must be capable of verification, reproduction, and independent analysis.”
Screenshots have become one of the most widely circulated forms of “evidence” in modern investigative work. They are sent to investigators daily, often treated by clients as irrefutable proof of wrongdoing, harassment, fraud, or contractual disputes. The problem is that screenshots are not designed, structured, or technically capable of serving as primary digital evidence. In fact, they routinely fail every authentic forensic standard used to validate digital information. In an era where digital content can be created, altered, or fabricated in seconds, investigators cannot afford to rely on screenshots as the foundation of any serious case.
This article explains in depth why screenshots should be treated only as illustrative material, never as digital evidence of record; why they fail under forensic scrutiny; how they can be manipulated easily through tools built into every modern computer; and what investigators must do to ensure that digital evidence collected from clients or witnesses actu-
ally meets the reliability requirements necessary for legal proceedings.
The False Sense of Evidence
To the untrained eye, a screenshot appears trustworthy. It is a picture of something real, captured in the moment, seemingly objective and tamper-proof. This assumption is one of the greatest sources of evidentiary failure in private investigations. While screenshots provide visual clarity, they lack the essential digital elements that constitute authentic, verifiable evidence.
Digital evidence, by definition, must be capable of verification, reproduction, and independent analysis. A screenshot fails all three criteria. It is a derivative representation of an image of pixels, not the underlying data. Just as a photograph of a printed document is not the document itself, a screenshot is not the original message, log, or record it claims to represent. Screenshots are
inherently incomplete, unauthenticated, and susceptible to manipulation.
The Metadata Problem
Every piece of digital evidence must contain metadata: information about the data, not just the data itself. Metadata includes timestamps, origin information, device identifiers, message IDs, logs, sender verification, and application-level data. A screenshot con tains none of these elements. It carries only superficial file-level metadata such as the date and time the screenshot image file was created. This says nothing about the authenticity of the content displayed
Without metadata, there is no reliable way to determine:
• Who sent the message
• Who received it
• Whether the message ever existed
• When it was actually created
• If the content was manipulated
• Whether the screenshot represents the entire context
• Whether the screenshot came from the device it claims to have come from
The absence of metadata makes screenshots scientifically unverifiable. Investigators should never accept digital evidence that cannot be authenticated through metadata or system logs.
The Ease of Manipulation: A Critical Vulnerability
Most investigators are aware that images can be edited using apps or software. What is less understood is that screenshots can be falsified in a matter of seconds without any special software. Every modern browser includes developer tools accessed through right-click > Inspect or Inspect Element. These tools allow anyone to modify the visible content of a webpage instantly and temporarily, without altering the server. This means a user can change:
• Names
• Dates
• Times
• Dollar amounts
• Chat messages
• Email content
• Shipping status
• Banking information
• Social media comments
• Profile pictures
• Entire conversation threads
The modified content appears legitimate, persists long enough to be captured in a screenshot, and leaves absolutely no trace in the resulting image.
A browser’s developer tools allow manipulation of the Document Object Model (DOM), controlling what is displayed on screen. These changes are local and temporary but are visually indistinguishable from legitimate content. A screenshot taken during or after a modification appears authentic to anyone reviewing it later. No forensic analysis of the screenshot image can reveal that the content shown was altered before capture. The image becomes a convincing replica of something that never existed. This is one of the strongest reasons why screenshots can never be foundational evidence. Their susceptibility to invisible tampering destroys their reliability at the most basic forensic level.
Chain of Custody Failure
Another fundamental problem is that screenshots have no inherent chain of custody. They do not establish:
• Who created the screenshot
• What device was used
• If the device belonged to the client
• If content was altered before capture
• Whether the screenshot was taken minutes, days, or years after an event
• Whether the account shown in the image belongs to the person implicated
Unlike devices or digital systems, screenshots do not contain internal identifiers linking them to specific hardware, accounts, or applications. This makes them extremely vulnerable to challenges during litigation. Investigators must be prepared to testify regarding the provenance of evidence. With screenshots, provenance is nearly impossible to establish.
Why Courts Increasingly Dismiss Screenshots
Legal systems worldwide have become more technologically literate. Courts now routinely reject screenshots because of:
• Absence of metadata
• Inability to authenticate the original device
• Lack of context showing the full conversation or record
• Inability to prove who controlled the account
• Risk of “deepfake” or AI-generated conversation text
• Suspicion of VoIP numbers such as TextNow, Google Voice, or Twilio
• Incomplete/inconsistent timestamps
• Evidence that the content could have been manually edited
In many cases, screenshots collapse the moment an opposing attorney asks a simple question: “Can you verify that this message was not altered?” No investigator can answer “yes” without proper forensic extraction. If your case depends heavily on screenshots, you risk having the entire claim undermined.
When Screenshots Can Be Used Legitimately
Screenshots do have value, but only in limited roles. They can serve as:
1. Demonstrative evidence: useful for illustrating what a client claims they saw.
2. Leads or clues: helping investigators identify areas for deeper analysis.
3. Supplemental evidence: only when paired with proper forensic acquisition.
Screenshots should never stand alone as proof of digital activity. They must always be validated or corroborated through primary sources.
What Private Investigators Should Do Instead
To protect your cases and credibility, professional investigators must follow proper digital evidence protocols:
1. Obtain the original device whenever possible.
2. Perform a forensic extraction using accepted tools and methodology.
3. Request logs or data directly from service providers.
4. Capture full conversation threads, not isolated images.
5. Document all steps of your evidence collection process.
6. Educate clients early about the limitations of screenshots.
By adopting these practices, investigators ensure that their findings meet the standards required for admissibility and withstand legal scrutiny.
Final Thoughts
Screenshots are useful illustrations but unreliable evidence. They lack metadata, context, authenticity, and resistance to manipulation. Browser-based editing tools make it trivial to fabricate realistic content. Without forensic extraction and corroboration, screenshots cannot meet the scientific standards required for primary digital evidence.
Investigators who continue relying on screenshots without verification expose their clients, their cases, and their own reputations to significant risk. The fix is straightforward: treat a screenshot as a lead to run down, not proof to rely on, and verify it through the original device or provider records before it reaches your report or the witness stand.
The Insidious Nature of Elder Exploitation Investigations
by Kathy Wolfe Brown
“In some cases, the person has integrated into the elderly loved one’s life to the point that they are often consulted or included in financial and personal decision-making.”
Cases of elder exploitation rarely present as crimes. They typically present as concerns and uncertainty. As something that does not feel right. A family member notices that a parent has changed; at times, money has been withdrawn from bank and brokerage accounts. A new person is frequently visiting. When asked about them, they respond defensively. A client calls about an out-of-state parent and shares, “I can’t point to anything specific; I just have a bad feeling.”
Over the past several years, we have observed a steady increase in a particular type of investigation: cases in
which elderly clients are financially and emotionally exploited not by strangers, but by people they trust, rely on, and often have grown to care deeply about. We describe this as trust-based elder exploitation.
Sometimes that person is a caregiver or a service provider. Sometimes it is someone they met at the grocery store who was kind to them and happens to be a housekeeper. In some cases, the person has integrated into the elderly loved one’s life to the point that they are often consulted or included in financial and personal decision-making. The specific role varies, but the underlying structure is consistent.
These cases tend to be insidious, built over time through trust and proximity, and, as they mature, often progress gradually toward isolation. These factors create an environment in which exploitation can occur without force or overt fraud, and often without any clearly illegal acts. That is what makes these cases challenging to uncover, unwind, and prosecute. It is also what makes them increasingly relevant to private investigators.
Why Is This Occurring More Frequently?
Adults 65 and older represent almost 20 percent of the U.S. population, and their growth is faster than that of any
other age bracket. Further, many adults over 50 prefer to age in place. These agerelated factors increase reliance on inhome services and informal assistance. At the same time, the U.S. faces persistent caregiver shortages, high turnover rates, and inconsistent regulatory oversight. In many cases, families are geographically distant, limiting the option for direct supervision if needed to care for aging loved ones. From a financial perspective, people born between 1946 and 1980 control more than 70 percent of U.S. household wealth. This concentration of assets, combined with age-related loss of spouses, geographical distance from family members, and declining health, creates an exploitable environment.
Trust-based elder exploitation differs from traditional fraud because it does not begin as a transaction. The exploitation starts as a seemingly caring personal or professional relationship, enters the home, becomes familiar, and over time, becomes normalized. That nor-
malization, and subtle relationshipbased nature of exploitation, makes detection and extraction challenging.
What These Cases Look Like Operationally
Trust-based elder exploitation cases rarely appear suspicious at first. Then the changes begin to appear. A caregiver becomes indispensable. A service provider becomes a personal confidant. A younger partner becomes emotionally central. A helper moves in “to make things easier.” The subject does not take money; the victim gives it. Access to the residence or cash is typically not demanded; the victim offers it. Isolation of the victim becomes the need for an appropriate level of independence or privacy.
Often, there is a significant age dif ference between the subject and their elderly victim. The older person is lonely, grieving, or managing the health decline of their spouse. The oftenyounger subject is attentive, consistent, understanding, and supportive. Over time, family members or friends may notice changes in spending, gift-giving patterns, and legal or financial authority. The victim exhibits increased defensiveness when questioned, withdrawal from family or friends, and greater secrecy around the relationship.
By the time concerns are raised or recognized, the victim is often emotionally page 32
invested and resistant to outside and family member input, even when objective indicators exist. Subjects engaged in trust-based elder exploitation usually display elevated vigilance, especially when they become aware of third-party involvement, such as that of a private investigator. With potentially significant financial benefit or control at stake, they become highly attentive to potential threats.
Victims, on the other hand, often exhibit embarrassment, defensiveness, and reluctance to discuss the relationship. Shame and fear of judgment reduce disclosure even when exploitation is occurring.
These Investigations Are Longitudinal by Nature
As investigators, we reconstruct the relationship timeline to understand when the subject entered the victim’s life, the circumstances at that time, and how the behavior evolved. We conduct thorough background investigations on the subject and prospective accomplices. We focus on historical patterns and behavioral changes rather than isolated transactions. We collaborate with the client and/or family members to review financial patterns, changes in authority, and shifts in social dynamics.
Based on those findings, we conduct targeted surveillance to document courtadmissible behavioral patterns, including subtle interpersonal interactions, business and personal meetings, inappropriate involvement in personal matters, and, at times, unrecognized collusion with other bad actors.
We have found that surveillance is often the most impactful evidentiary tool. Surveillance allows investigators to document where the subject goes, who they interact with, and how that behavior compares with what the subject has shared with the victim. It identifies inconsistencies between narrative and activity and frequent ly reveals parallel residences, undisclosed
“Family members, partners, or associates of the subject often know about and benefit from the exploitation. In some cases, they actively assist in validating stories and concealing the subject’s actual circumstances.”
relationships, addictions, and other secretive misrepresentations.
Surveillance also plays a critical role in identifying accomplices. These cases rarely involve a single isolated bad actor. Family members, partners, or associates of the subject often know about and benefit from the exploitation. In some cases, they actively assist in validating stories and concealing the subject’s actual circumstances.
Extended surveillance of both the primary subject and related individuals frequently reveals coordination, shared benefit, and mutual awareness. For this reason, background investigations and surveillance should be conducted on the broader network, not only the primary subject.
These cases require integration of behavioral analysis, financial review, background research, and surveillance. Much of this conduct is exploitative without being clearly prosecutable. Investigators must therefore operate with precision. Our role is not to accuse, diagnose, or intervene. Our role is to develop fact-based, courtadmissible evidence and documentation. We establish facts, patterns, and risks so that families, attorneys, and courts can act appropriately.
Conclusion
Elder exploitation is no longer a peripheral issue and is becoming a core category of investigative work. It is emotionally sensitive, financially significant, and professionally complex. Handled well, it prevents harm and preserves dignity, ideally before the victim has been emotionally and economically devastated. As the population ages, investigators will encounter these dynamics more frequently.
Trust-based elder exploitation is insidious, adaptive, and likely to increase as demographic, economic, and social conditions continue to evolve. It does not require force and often operates within legal gray areas. That said, its impact on autonomy and financial security is substantial and lasting.
Through careful observation, documentation, and professional expertise, investigators can provide the clarity that families, attorneys, and courts need to intervene before financial and emotional harm becomes irreversible.
Stay Informed
Working PI is the only magazine available to all PIs at no charge in print and online!
Receive every print issue AND get the latest PI news via email.
Opt-In for the Digital News at WorkingPIMag.com
The latest news—delivered right to your inbox twice a month.
Learn From the Best + Develop Your Skills
Working as a Subcontractor
by Catherine Torrez, TBCI, Owner-Private Investigator/Public Speaker/Author
“If you need additional help from others, get approval from the contracting company before bringing in other subcontractors.”
Many times, we read a Listserv request from a fellow investigator seeking assistance from other investigative professionals in other regions or other parts of the country. Periodically, we may also see a need for an experienced investigator who has a different skillset than what that agency offers. What could you and what should you consider before accepting the case?
First and Foremost
Although the primary investigative firm is expected to verify that a case is legitimate, legal, and ethical, it is essential not to assume this has been done.
Independent confirmation of the client’s background and the methods to
be used is always necessary. Failing to independently verify these aspects can expose investigators to legal liability or ethical breaches, underscoring the importance of thorough due diligence.
The Scope of Services
Before accepting a case, ask yourself if you have the necessary experience. Remember that both your reputation and the contracting company’s reputation are at stake. For example, if you fail to deliver quality work, word may spread within professional associations, potentially harming both companies’ reputations.
Always give the same level of effort to the contractor as you would for your
own clients. If you need additional help from others, get approval from the contracting company before bringing in other subcontractors. They may want to check those subcontractors’ licenses, bonds, and insurance. Maintain confidentiality and follow ethical standards at all times to protect everyone involved.
Subcontractor Agreements: Best Practices for Investigators
A written agreement ensures both parties understand the services involved. Clearly outline payment terms, including hourly rates, mileage, and which expenses will be reimbursed, such as meals purchased during surveillance in food or drink establishments. Specify conduct requirements, such as whepage 36
$100,000 CYBER COVERAGE
Why Private Investigators Need Cyber Coverage:
Scenarios
1. Hacked Emails ($100K) - Scenario: Your email account is compromised and then sends malware to your contacts. Up to $100K Third-Party Liability coverage applies.
2. Payment Data Breach ($100K) - Scenario: If you require a retainer fee for an upfront payment from clients, this protects from payment data breaches. Get coverage for investigation, notification, and damages.
3. Lost/Stolen Device ($100K) - Scenario: Did you know that if your laptop/phone with client data is stolen, you could be required by law to notify clients, provide credit monitoring, and you could face fines ($500-$5,000 per record)? This coverage pays for notification and legal costs.
ther subcontractors may consume beverages to blend in, and clarify any alcohol restrictions during operations.
A Checklist for Subcontractor Agreements:
☐ Hourly and mileage rates.
☐ Reimbursable expenses (e.g., meals, travel, tolls, use of rental cars).
☐ Behavioral standards while performing surveillance operations.
☐ Alcohol policy and other professional conduct requirements.
☐ The use of GPS location devices, drone photography, use of field cameras, etc.
☐ Are there any Protective Orders in place?
☐ Contact or no contact with target and advise if the target is represented by counsel.
☐ Indemnification/Insurance: Insurance providers (like OREP) recommend that the hiring firm (A) include an indemnification clause in the agreement wherein the sub-
“A written agreement ensures both parties understand the services involved. Clearly outline payment terms, including hourly rates, mileage, and which expenses will be reimbursed, such as meals purchased during surveillance in food or drink establishments.”
contractor agrees to indemnify the hiring firm for mistakes made by the subcontractor and (B) require insurance when the subcontractor is a private investigator.
☐ Other considerations specific to the case.
Conclusion
Subcontracting can be efficient and profitable for everyone involved, but only if both parties communicate well and terms are put in writing before work begins. Without clear communication and
an agreement, the same arrangement can turn into a legal dispute.
The use of subcontractors allows investigators to take on clients that may exceed the agency’s internal skillset. By outsourcing those specific duties to a subcontractor who proves to have high-quality experience and training with those skills, you open a door to being able to provide services that you may not otherwise provide.
Do you struggle with the “cash flow” part of your business?
Are you ready to grow your business but don’t know the mechanics of working with subcontractors or employees?
Want to develop a more consistent work product?
Want to market your business to attorneys but not sure how to go about it?
The Narrative Trap: How Confirmation Bias Undermines Legal Due Diligence
by J. Alexander Chilton, LPI GA/SC
“In practice, confirmation bias does not typically manifest as an overt or easily identifiable flaw. Instead, it emerges through a series of incremental decisions that collectively shape the trajectory of the investigation.”
In legal due diligence, corporate inquiries, and workplace investigations, facts are not merely informational—they are determinative. Attorneys rely on them to assess liability and shape litigation strategy. Corporate leaders depend on them to manage risk and protect organizational interests. Human resources professionals use them to make decisions that can significantly affect both individual careers and institutional exposure. Within these contexts, the investigator’s role is clear: to develop an accurate, objective, and defensible factual record.
Despite the importance of that mandate, one of the most significant threats to investigative integrity is rarely addressed in practical terms. It is not a matter of competence or diligence, but rather a cognitive vulnerability inherent in human reasoning. This vulner-
ability is known as confirmation bias, and within investigative practice it is often described as the “narrative trap.” When it takes hold, it can subtly but materially distort the course of an investigation, even when the investigator is experienced and well-intentioned.
Every investigation begins with context. An attorney may present a theory of the case, a corporate client may report suspected misconduct, or a human resources department may initiate an inquiry based on a complaint. These inputs are necessary because they establish scope and direction. However, they are not evidence. The narrative trap begins when this initial context evolves into an assumed conclusion rather than a working hypothesis. At that point, the investigation can shift—often imperceptibly—from an open-ended inquiry into
a process aimed at confirming what is already believed to be true. The operative question changes from “What do the facts show?” to “How do we support this position?” and that shift fundamentally alters the integrity of the investigative process.
In practice, confirmation bias does not typically manifest as an overt or easily identifiable flaw. Instead, it emerges through a series of incremental decisions that collectively shape the trajectory of the investigation. An investigator may give greater attention to documents, witnesses, or data sources that align with the initial theory while allocating less effort to alternative lines of inquiry. Interviews may become subt ly directional, encouraging responses that reinforce the prevailing narrative rather than eliciting independent accounts. Ambiguous facts may be interpreted in
a manner consistent with the working assumption, and information that complicates or contradicts that assumption may be minimized or excluded. Each of these decisions, viewed in isolation, may appear reasonable. Taken together, however, they can produce an investigation that is coherent and persuasive on its face but ultimately incomplete.
The consequences of such an approach are significant, particularly in legal and corporate environments where investigative findings are relied upon to make consequential decisions. Attorneys who base litigation strategy on biased or incomplete findings may find their positions undermined when opposing counsel exposes gaps or inconsistencies. Corporate entities that act on flawed investigations may face legal challenges, including claims of wrongful termination, discrimination, or procedural unfairness. In many cases, the issue is not that the investigation contains inaccurate information, but that it fails to present the full factual landscape. When subjected to scrutiny through discovery, deposition, or internal review, these omissions can become highly consequential, diminishing both the credibility and utility of the investigation.
A common scenario illustrates how easily this dynamic can develop. In a workplace investigation, an allegation of misconduct is made against an employee. The organization initiates an inquiry with the expectation that the allegation has merit.
The investigator begins by interviewing individuals identified in the complaint and reviewing supporting documentation. Inconsistencies in the subject’s statements are noted, and corroborating evidence is emphasized. However, less attention is given to identifying witnesses who may offer alternative perspec tives or to examining contextual factors that could explain the conduct in question. The resulting report presents a clear and internally consistent narrative, but it may lack balance and fail to address competing explanations. If challenged, the investigation may be criticized not for what it includes, but for what it omits.
Avoiding this outcome requires more than general awareness of bias; it requires a structured and disciplined approach to investigative work. One of the most effective methods for mitigating confirmation bias is the adoption of a competing hypothesis framework. Rather than relying on a single narrative, this approach requires the investigator to identify multiple plausible explanations at the outset and to evaluate each of them systematically against the available evidence. By doing so, the investigator reframes the objective of the inquiry. The goal is no longer to confirm a particular theory, but to determine which explanation is most consistent with the totality of the facts.
The application of this framework begins with the deliberate formulation of alternative hypotheses. In the context
of a workplace investigation, for example, the investigator might consider the possibility that the alleged misconduct occurred as reported, that the conduct occurred but was misinterpreted or taken out of context, or that the allegation is unfounded or influenced by unrelated factors. By articulating these possibilities explicitly, the investigator creates a structure within which evidence can be evaluated more objectively. Evidence collection is then designed to test each of these hypotheses rather than to support a single narrative. This requires a comprehensive approach to witness identification, document review, and information gathering, ensuring that the investigation captures the full range of relevant facts.
Equally important is the manner in which evidence is evaluated. Within a competing hypothesis framework, particular weight is given to information that challenges a given explanation. Evidence that contradicts a hypothesis is often more informative than evidence that supports it, because it helps eliminate incorrect conclusions. This analytical discipline requires investigators to engage actively with conflicting information rather than disregarding it. It also necessitates a willingness to revise or abandon initial assumptions in light of new evidence.
Another critical component of this approach is the avoidance of premature conclusions. Once an investigator forms page 40
a definitive view too early in the process, subsequent analysis tends to align with that view, reinforcing bias. By delaying conclusions until all relevant evidence has been collected and assessed, the investigator preserves the integrity of the analytical process. The final stage of the investigation reporting must also reflect this discipline. A well-constructed report presents findings in a clear, chronological manner, documents both supporting and contradictory evidence, and avoids speculative or conclusory language. Its purpose is not to advocate for a particular outcome, but to provide decisionmakers with a reliable factual record upon which to base their judgments.
For attorneys, corporate clients, and human resources professionals, the ability to recognize the characteristics of a high-quality investigation is essential. Investigations that are comprehensive, methodologically transparent, and grounded in neutral language are inherently more reliable. They provide a more complete understanding of the facts and are better equipped to withstand scrutiny. Conversely, inves -
tigations that appear overly polished or conclusory may warrant closer exam ination, particularly if they lack evidence of balanced fact development.
Clients play an important role in shaping the investigative process. The way an assignment is framed can influence the investigator’s approach. When in s tructions are presented as conclusions, they may inadvertently encourage confirmation bias. By contrast, framing the assignment as a request for objective fact-finding reinforces the expectation of neutrality. Engaging investigators who prioritize methodological rigor and who are willing to challenge assumptions is a critical component of effective risk management.
At its core, the issue of confirmation bias is one of professional responsibility. Investigators operating in legal and corporate environments are entrusted with developing factual records that may influence significant decisions and withstand external scrutiny. The standard they must meet is not simply whether their findings are persuasive,
but whether they are complete, objective, and defensible. That standard cannot be achieved when an investigation is driven by a single, untested narrative.
Confirmation bias is a practical and pervasive risk that affects investigations across disciplines. It arises naturally from the human tendency to seek coherence and consistency, but in investigative work, that tendency must be actively managed. The adoption of a competing hypothesis framework provides a structured means of doing so, enabling investigators to produce findings that are more balanced, more accurate, and more resilient under scrutiny.
For those who rely on professional investigative work—whether in legal due diligence, corporate governance, or workplace management, the implications are clear. The value of an investigation is not determined by how effectively it supports an initial assumption, but by how rigorously it tests that assumption against the facts. In the end, the objective is not to confirm what is suspected, but to establish what is factually true.
Professional Investigators
Industry-Leading Insurance for
Few Programs truly specialize in Investigator Insurance.
We Do. It Matters.
Whether you’re out in the field, or doing background research from your office, OREP’s got you covered.
General Liability and E&O Coverage in a Single Policy
Includes $25K in Business Personal Property Coverage
Includes Independent Contractors at no extra cost
Comes with Blanket Additional Insured
Includes Security Consulting and Executive Protection
Over 14,000 Professionals Trust OREP with Their Insurance
