What Makes an Investigation

In Short: A look at the most important elements of an investigation: what makes good evidence, how to develop a strong documentation process, the value of verification, and the key to a safe start.

Building solid evidence

Throughout this kit, we will use the generic meaning of evidence: information that is material to the question, problem, person or process you are investigating. There are legal definitions of evidence that can be much stricter, but this generic meaning serves more diverse investigations.

Evidence provides you with the confirmation of a claim or assumption. It is proof of something that happened, or of something that didn’t happen. Interpreting and attributing meaning to information you collect produces a body of evidence. It’s important to keep in mind that not every piece of information is, or can turn into, evidence.

An investigation is a process of organised evidence collection, which seeks to be as close to the truth as possible. The past leaves behind residue: dust, footprints, documents, videos, audio recordings, witnesses, scents, paperwork, the presence or absence of something that was or wasn’t there before. Collecting evidence means finding and verifying these traces. While it’s impossible to recreate history, these traces of events, relationships, transactions or places can work to prove that your story is based in reality.

If you think about your investigation as a jigsaw puzzle, each link or connection brings you one step closer to seeing the larger picture. As you connect more pieces, the picture starts to become clearer. No matter how much information you collect, you always have something you didn’t have at the start: a clearer framework to search within, a sketch of an image or map, a new source of information or even the starting point for a new investigation. Identifying links between the pieces of information will bring you closer to the answers you seek, and the evidence to prove them.

When you collect enough good evidence, the information you have will be well supported and closer to the truth. Otherwise, any conclusions you try to reach will be incomplete at best and completely wrong at worst. You want a solid, unshakable foundation.

Your checklist for good evidence

Not all evidence is good or relevant. There are some qualities that distinguish what is “good” and useful for your investigation. The best way to make sure you are on the right path is to test the strength, accuracy and integrity of your information, and to ask yourself a few guiding questions.

Good evidence is first-hand. Did you witness something yourself; do you have access to the persons involved, or to official documents about it?

Good evidence can be documented and preserved. Are you able to map the path that led you to the evidence, record every step of your research process, and save it in a way that other investigators can later access it, confirm its accuracy and make sense of it?

Good evidence is timely, created or documented close to when the event occurred. Did a lot of time pass and make the evidence less traceable? Did recordings or documents get lost? You will need to dig up the past or find new information elsewhere.

Good evidence can be verified. Can you and others check and confirm that what you have is real and accurate?

Good evidence has origins that can be confirmed by a third party, in addition to you and your source. Are you the only one who has access to the source of information, and the only one who can say it is real? If so, this can become a weakness if someone should challenge your evidence or claim you are making it up. However, if you are dealing with a vulnerable source, keeping it a secret may be your - and their - only viable option.

Good evidence contains information that can be confirmed by a third party. Is there anyone or anything else that can support your claims and evidence? An expert, another witness, an organisation doing research on the issue, an official document. The more, the better.

Good evidence can be shared with other people. Are you able to show this evidence to support your arguments and claims, or is it confidential and therefore needs to stay undisclosed? If that’s the case, you might need additional ways to prove to others that what you are saying is true.

Good evidence has a documented, unbroken chain of custody. Did you log every step of your research process? Did you save all findings with exact source details, dates, times and places where you found the information? Did you save all the information safely and make sure it never left your hands, was not tampered with and you can always trace everything back to its original source?

Good evidence is uncorrupted and kept safe from tampering. Can you make sure that nobody unwanted has access to it and can modify it in any way?

Good evidence includes metadata such as information about its author, location, time. Can you confidently say that you know a photo or a video was taken where the source claims it was, when it claims it was, and shows what it claims it shows? If you collected the evidence and recorded the images yourself, can you prove their authenticity by preserving their metadata? Any lost metadata can be a weakness to your evidence later on. Make sure you keep it safe.

Good evidence connects to other pieces of evidence and links information together. Can you connect your evidence with other information and findings from more sources to support your argument or create a stronger narrative about the issues you are investigating?

Good evidence will direct you to places where your information is weak or incomplete. Does it open up more questions, show you information gaps and new ways to seek additional evidence? That is a good thing, it will help you gain a better overview of the issue and ultimately build a stronger argument.

Good evidence doesn’t expose human sources to risk that the investigator can’t manage. Could someone directly or indirectly link your evidence to a vulnerable source whom, if exposed, may be in danger? If yes, can you reduce those risks in any way to protect that source? Is there any way to find other evidence, which supports your narrative but does not expose the potentially vulnerable source? If not, you may need to reconsider using that evidence and put the safety of your sources and of yourself first.

Good evidence may challenge your preconceived ideas or even contradict what you think is true. Does it show that your expectations or arguments aren’t valid? Does it make you see a problem from a different perspective, or even totally change your mind about an issue? Did you believe a source but ended up doubting it once you analysed more evidence from other sources? This is a good thing, and by admitting and accepting it, you are becoming a better, more impartial and hence more trustworthy investigator.

Good evidence speaks for itself. Can you just show what you have and be confident that people will understand the information and its meaning? Or do you still need to build a larger picture or a narrative to boost it?

Not every piece of evidence you discover will meet all these conditions. That’s to be expected. But some of the evidence you find will meet a lot of them – those pieces are the ones you may want to prioritise.

Without documentation, it didn’t happen

Collecting evidence, following leads, interviewing, modelling, mapping, planning and all the thinking that form your investigation will be more useful to you – and more supportive of your conclusions – if you document your process. This means keeping track of every step you make; every piece of data and evidence you collect with details such as what it is, where, when, why and how it was collected; preserving this data in its initial form and features, and much more.

The primary goal of documentation is to create a verifiable record of your investigation. Let’s call it ‘investigative hygiene’- regular maintenance of certain practices to ensure your investigation is healthy and can stand up to scrutiny and criticism if anyone tries to dismiss your evidence.

Your record is as much for you as it is for others. Keeping track of your steps will make you more effective as an investigator and less likely to struggle with common mistakes when starting out. As you progress, documentation can help you remember prior conclusions, how you got leads or evidence that seemed useless before but now seems important. You might also find things you forgot to follow up on or problems you wanted to ask someone else to help with.

Being able to confidently state why you pursued one source over another makes you a much more valuable and trustworthy resource. Your documentation habits are important if you intend to publish your findings, if you ever speak to law enforcement, if you pursue a case to court or offer your evidence to human rights defenders who represent cases of crime and abuse. Also, should personal or professional problems or changing socio-political conditions interrupt your work, it will be easier for someone else to interpret it and take on the rest of the investigation or use the evidence you managed to uncover. These habits are also useful if you end up collaborating with other partners.

While documentation is important, there are also risk factors. Your investigation logs may benefit potential adversaries – for example, someone determined to stop you from uncovering their wrongdoing – if the information falls into the wrong hands.

It is crucial that you assess any potential risks at the start of and during your investigation. You need to take your safety and that of your sources seriously, as well as keep evidence and documentation safely, using encrypted storage and devices to protect it from unwanted access.

Make sure you always inform yourself about basic digital and physical security safeguards and learn about tools and skills you may need in order to stay safe and keep your data stored securely. We will address such issues through The Kit but you can also start checking available online resources such as Tactical Tech’s Security in a Box or this Security Checklist. When working in particularly complex situations or environments, ask trustworthy people to advise you or look for safety trainings you may be able to attend if you feel that any of the investigations you pursue may pose even the slightest risk.

Tips for thorough documentation

Take detailed interview notes

If you are interviewing sources or meeting with other investigators, always take notes. Record the date, start and end times, location and names of participants. Note what was discussed and if the same people may hold a follow up meeting (“Person X and I decided we would speak again over the phone on Thursday at 14:00”). You can take notes by hand or type them on a device or both, as long as you are able to keep them safe. Audio recording is also a good way to keep track of conversations but obtain the others’ permission to record first. Beware of exposing people’s identities, especially when interviewing and recording vulnerable sources. Everyone’s safety should always be your top priority.

Investigators often use hidden recordings to help expose important information, but we choose not to address it in this kit due to controversies regarding legal limitations in some places and most importantly, the safety risks associated with it.

Keep track of contact information

If you are creating a list of contacts, include not only their names and contact information, but also how you came to know them, each time you have spoken and a summary of the information they have offered you. If you have a list of businesses, phone numbers, or email addresses to research, for example, make sure you note where you first encountered the business name, phone number or email. If you have sensitive information and vulnerable, at-risk, sources, give them an alias in all your notes and working documents, online and offline.

Record your process

Keep a log of investigative steps you have taken and their outcomes, with dates and details of every tool and technique involved in collecting evidence. For example, you might record: “On 3 January 2018, I and my research partner captured satellite images using Google Earth and documented the location of the company’s construction sites” or “On 14 March 2018, I tried calling different public phone numbers associated with the company to see if I could get records, but I was diverted to voicemail.” As you advance in your research, especially with long term investigations, this will help you remember past steps, you will be able to recall failed attempts to find certain data, or pieces of information you already have and shouldn’t duplicate.

Make an outline

As you gather more and more information, it’s helpful to create a rough narrative outline of what you have figured out so far. This will serve as a record of different stages of the investigation, and will help you see what information may be missing, if there are new directions you need to consider, and if certain information should be verified or refined. Also, creating visual maps of your data and investigative process may help you see things in a new light.

Protect your evidence

You should create both a physical and a digital log of all the evidence. Include dates, origins, storage location and security information. Your log should also include a description of the status of the evidence, who collected it and who has interacted with it. Keep all of this safe and preferably not all in one place to avoid total loss or damage.

If it’s not verified, it’s not valid

Your town has a decade-old sewage problem, but the mayor claims he has a magic wand that can fix it, if only you would vote for him another time? The neighbouring country is sending troops your way to take over the only clean water resource left in the region? Sure, anything is possible, and there may even be data available to prove it. But if it’s not verified, it’s not valid.

Verification is increasingly important as the quality and trustworthiness of information available today is being challenged from multiple directions – from “fake news” creators and misinformation trolls to ill-informed social media users who spread news without checking sources first.

For example, during the Kenyan election in 2017, fake tweets that looked like BBC or CNN stories were circulated with the intention of misrepresenting the political situation. In India, widely disseminated fake information about alleged criminals has led to people being killed or beaten in the streets.

Whatever the goals of your investigation, it’s important to be able to defend how you got to the information you are presenting as evidence. If something in your investigation is proven not to be true, it undermines your research and any narrative or conclusion you present.

Most of the investigation techniques in this kit can be used to uncover evidence as well as verify it.

There are different levels of evidence during an investigation. Whatever path you follow, you’re always trying to get closer to the first-hand evidence through techniques like verification. Here are some examples of sources of information you may need to address and verify throughout your investigations.

Word of mouth. A neighbour heard that members of a minority group in your community are being denied service at a local authority. This sounds more like a rumour for now, so you will need to get closer to the facts.

Expert statements. A researcher who has tracked this sort of denial of service to minority groups tells you it’s frequent. An expert statement is a good way to start validating the information you have, but you still need to collect some first-hand information or find more sources stating the same.

Second-hand accounts. You speak to people being denied this service. You are getting closer to the actual facts, but any personal experience and statement needs to be checked with other witnesses or existing documentation, if available.

Research documents or reports. For example, a report from a credible NGO describes this occurrence based on interviews with directly involved community members. Documents resulted from research bring you a step closer but just as with the expert statements, you still need to corroborate these with witness accounts or at least another source stating the same.

Official documents. An official paper documents the denial-of-service incident. Signed and dated official papers are always a very strong piece of evidence as you can identify the institution and people responsible for documenting the case and follow-up with more questions if you need to. Mind institutional bias, when an office may want to hide data rather than expose the truth, especially if it incriminates them. You have a good piece of evidence in your hands now but some witness or expert statements will make it stronger.

Photos, video, audio. A recording exists showing the situation occurring. This can be a treasure of evidence for you. If the images and audio are real, they can be linked to the location, time and people involved in the incident. Watch out for image and sound manipulation by checking EXIF data and metadata, verify the source, the contents and do not use it as evidence without reaching out to those involved to confirm its accuracy.

First-hand evidence. You are present while the situation occurs and maybe you even manage to film the incident. This is first-hand evidence and the strongest for your investigation. You have the opportunity and, at the same time, the responsibility to document the entire incident thoroughly. You also want to make sure you establish contact with others involved to be able to confirm your observations and evidence, should anyone doubt the accuracy of your investigation later on.

When to verify

The short answer is always.

Verification is an iterative process. You have to keep doing it over and over again. The process is not only related to one piece of evidence you uncover, but also to how all the pieces fit together.

Any new evidence you find may cast reasonable doubt on old evidence that you may have already verified. That is why documenting your evidence is important; so that you can retrace your steps and verify again and again.

Challenges of verification

While at the heart of the investigative process, verification has many obstacles, too. It helps to consider them even before getting started.

Besides how to find other sources of information, your own assumptions can be one of the biggest challenges to overcome.

Whatever you assume about what happened, personal biases will affect how you handle and verify information. Many times, you may just look for sources of information that confirm your biases rather than examine aspects that could contradict your findings.

Your assumptions about the credibility of your human sources can also get in the way of proper verification if these assumptions are not true. It is essential not to take anything for granted since even the most trusted and reliable of sources can sometimes get it wrong, even if unintentionally.

Another challenge is finding creative ways of verification – to be ready to use sources of information in ways they were not intended. For example, if you want to verify whether a public official was somewhere despite him denying so, you may not only want to visit his social media accounts, but also those of his relatives and friends to find clues of messages, comments and images that may confirm or deny that.

How to verify

It helps to first think through any questions or doubts you have about the information you’ve gathered, as well as about your own assumptions and the potential bias you or others involved may have.

What do you know with 100 per cent certainty?

If it’s an image, do you know who took it? When was it taken? On what camera? In what place? How do you know it hasn’t been modified? Could anyone try to mislead you by providing this image?

Can you truly confirm that subjects and events shown in an image are from the specific day, time, place and incident you are investigating?

Is the issue contentious? Are there sides that have something to gain by spreading this information? There are groups spreading false information hoping that someone might give them attention without checking.

There are three main phases of verifying information:

Verifying the source. Where you got the information and where it originated.

Verifying the content. Whether it is exactly what it claims to be.

Verifying its relevance. Whether it fits in to your investigation.

In any investigation, you’ll collect information from many different sources. Some will be obvious, while others may be less clear. You could get an anonymous email, an envelope of documents, see a video on social media or find a document on a random website. If there is any question about the origin of that information, it’s important to verify where it came from - whether it was from the original source, whether it is from someone trustworthy, whether it is accurate or has been fabricated or tampered with, and whether there was some motive behind getting that information to you.

Information and evidence can take various forms and appear on various mediums. Images, videos, sound, written testimonies and webpages are just a few. For each medium there are tools, techniques and tricks that help with the process of verification, and you will find many of them explained in this kit.

You do not need to learn everything about every medium before you start investigating. There will be plenty to discover as you go along, and you will also be able to learn through practice. Complex guides to verification written by experts in the field are also available for you to check if you wish to go in-depth (for example, the Verification Handbook, or the Journalism, Fake News and Disinformation handbook by UNESCO).

In order to rigorously test your evidence and keep your biases in check, you can document your research process and your findings and present them to other investigators to confirm that it makes sense to someone else.

However, always make sure you trust those you are sharing information with at any stage of an investigation and that you – and any collaborators – are aware of ways to stay digitally and physically safe as you communicate and share information. Each topic addressed in this kit also contains useful safety warnings and advice for those of you investigating on your own or collaboratively.

Taking care of your emotions

Over the course of an investigation you will have to deal with your personal feelings, principles and values in addition to establishing your methodology, collecting and verifying information, building evidence, and so on. You will need to identify possible biases and also be careful not to undertake more than you can handle emotionally. These concerns are valid when working with any type of methods and resources, online and in the field, or with human sources and interviewees.

Personal emotions

Mental health issues like depression and Post Traumatic Stress Disorder (PTSD) commonly affect investigators dealing with difficult topics. Cumulative stress and the responsibility that you have for your subjects, your colleagues, family, and yourself shouldn’t be underestimated. It is okay to feel low and frustrated, and to seek the counsel of more experienced investigators.

Speak up, and find effective therapy options if you feel that your investigation is taking a toll on you. Experiencing or hearing about trauma or investigating corruption or injustice, for instance, may put a lot of pressure on you. Often, investigators feel that people need them to keep investigating because they may need help right away. This can produce a sense of responsibility and may even convince some that taking the time to step back and deal with their reactions is a luxury they simply can’t afford. Investigators, activists, human rights defenders, and many others who deal directly with issues affecting people around them may often feel this way. This is also one of the main factors that drive investigators to continue their work, so it might be something that drives you, too.

Your self-care, just as your safety, should always come first. If your capacities are dwindling due to your state of mind, that will influence your investigation. If at any moment you feel that you can’t cope, you have every right to take a break or even let go of something that is harming your well-being. Moreover, even when you aren’t feeling this kind of helplessness or stress,it’s good to take breaks once in a while and to talk to others about how you feel. Look on the bright side and consider that even when your investigations might not be as successful as you want them to be, you are always trying.

Bias

Sometimes it will be difficult to set aside your emotions, whether they are feelings of anger or sadness. Even when you are in the right mindset,situations like confronting an adversarial source or listening to a vulnerable witness can trigger your own feelings. If this happens during the interview or at any stage of your investigation, you have to be able to focus on your evidence collection process and your questions. Remember that you are a mere recipient of the evidence provided and try to keep your mind calm and collected in order to achieve your goals.

It’s natural to become emotionally involved with a story, particularly as you speak to sources you sympathise with. Our unconscious biases make us more interested in hearing some stories, and less interested in others. You should accept that you cannot remain a completely detached observer. But you should still strive to be mindful of your biases and seek to act in a fair and honest way as much as possible. Your investigation may fail if you push a certain point of view at the expense of others, or neglect important context due to your personal bias. This can also damage your reputation and trustworthiness.

Holistic security

There is no better expression to illustrate what it means to be safe on the outside and safe on the inside. Holistic security implies a method and way of work and life that takes into account physical and emotional factors. This approach is promoted and encouraged among high-risk communities of human rights defenders, gender activists, investigative journalists, community organisers, citizen investigators and others. It’s not only about adopting physical and digital safety habits and measures that apply to your communication, research, travel or relations. It goes further and addresses ways to stay physically and mentally aware and sane, care for yourself and for those around you and take time to reassess the relevance, impact and toll of your work on yourself and others. To get you started, we recommend the Holistic Security guide published by Tactical Tech through long-term collaborations with individuals and communities researching, working and living in stressful situations.

Start where you are

When you are just beginning to investigate, it makes sense to approach the process from the most comfortable and safe point of entry.

If you are the type of internet scout who knows tonnes of social media research tricks or are good at digging into databases and indexing online information about various topics, start with that.

If the virtual space is not your thing, maybe start by observing and documenting what happens in the physical world. Take photos, make detailed notes about events and situations, talk to people and see if you can gain their trust and build sources.

There is no point in starting your first investigation by experimenting with a completely new or uncomfortable way of gathering information. Just start with what you are good at.

With the availability of digital devices and numerous sources of information on the internet, it is possible to conduct various tasks of an investigation from behind a desk. Digital investigations often mainly involve desk research, but they can also include basic offline research, such as going to the library and archives, making phone calls or a combination of all these.

Digital investigation means that you are using digital tools and media to investigate. The subject of your investigation can be digital, such as a YouTube video, or it can be analogue, such as the real estate assets of a politician.

Databases that are accessible on the internet are an opportunity for investigators to uncover information beyond the traditional method of digging into archives of physical records. More and more data can be collected, filtered, connected and verified using digital tools. Yet, conducting investigations from behind a screen is not as safe and straightforward as it may first appear.

There are many digital threats to investigations, particularly if those being investigated are wary of being traced. That’s why, even when conducting digital research, there are important safety measures you need to be aware of in order to reduce the risks. You will read about them throughout this kit.

For some investigations, pen and paper is a more appropriate approach. A combination of traditional and new investigation techniques can be very effective.

Often, despite the abundance of online information, there is evidence that you cannot find with digital resources. It might be the case that there is no data about your topic available in your country. However, you can often find more than you expect just by opting for creative ways of information gathering.

For instance, donor-funded NGOs all over the world are required to conduct background studies to explore the context of their field of interest before starting any project. During this process, they often conduct surveys and collect detailed datasets that never get published.

You might need to find out how many former militia fighters returned to their home villages in your district and that is not an easy task. But an organisation providing psychological support to that specific group may have those numbers available. Similarly, you might want to know how the contamination of a river has affected your local community but it is difficult to collect accurate, scientific proof about this. Perhaps there is an environmental NGO that conducted research and interviews with those who got ill because they drank the contaminated water.

In many cases, such information is not easily accessible to the public especially when it was meant to serve as background data for other purposes. However, if you ask the NGO and explain why you need this data, they might often be ready to give it to you, or to help your investigation move forward.

Some investigations will require you to conduct your own field work to gather evidence and verify it. Field research means that you identify and collect the information first hand and it is your responsibility to document it and confirm its accuracy. It can consist of recording testimonies, gathering samples, observing events and places or going out to various places to talk to people. These approaches will also be addressed throughout the kit.

You also want to be careful when doing field research. Whether you are contacting people to find out if they can be your sources, meeting them to collect more information, or going out to a location to examine evidence, it’s vital to be aware of the various risks involved at every step. Risks to your personal safety and that of others might be high. Sometimes you can reduce those risks, but other times they may be too overwhelming for you to conduct the investigation.

Knowing when to reconsider, ask for help, or set a project aside for a while if possible, is also a healthy attitude and asset to have as an investigator.