SI Cyber Blog

When SI was originally founded as “Special Investigations” in 2014—and then expanded in 2017 and 2020—we had a lot of conversation about how we should represent this firm . . . and that conversation continues.  We talk about our strategic dimension—what Michael Porter called “differentiation focus”—and our responsiveness to an ever-expanding client base.  We are beginning to mature, operationally.  We are in some of our biggest and most consequential cases.  We are positioning for growth again.  We are adapting.

Investigations and cyberadvisory engagements with high levels of energy, integrity, and success get particularly self-critical along the way.  So it wasn’t any surprise to us when our strategy discussion took that turn.  After all, our most important resource-based competitive advantage is that as investigators and in cybersecurity, we have all run companies and served on corporate boards in positions of actual fiduciary responsibility—and that includes especially the six C-suite executives who make up our Board of Advisors.

Our discussion started with something archival, from the original Special Investigations in 2014.  Then, our firm had a thirteen-word longform marketing tagline.  It was prominent on the home page of our company’s first website and in the printed materials that we provided in confidence to clients and legal counsel.

The tagline was to-the-point, but it had a problem.  It read:

Experienced fiduciaries
Without law enforcement bias
Investigators with special capabilities
And global reach

That second line, “without law enforcement bias,” was the problem, and it got us thinking and talking—a lot.  “I hate that,” one of our founding partners, Ellen Cole—now SI’s managing director—said forcefully.  (She is not known for holding back.)  “I just don’t want it on our website.”

Notice that it isn’t on our website.

But we believe that it’s worth explaining how it got there in the first place, years ago.

The predecessor to SI . . . before we ever made our first acquisition . . . took more than two years to form, capitalize, and license, beginning with our concept as the first investigative firm ever to be formed out of the securities and financial services sector.  Notably, our original investigator-partners were not former law enforcement officers—although all of us have worked extensively with law enforcement, and our CEO supervised federal law enforcement officers conducting investigations.  Today, our larger field of operatives, investigators and the technical specialists we have for special operations, certainly includes former LEOs.  We genuinely like law enforcement and we are constantly communicating professionally with LE during our investigative engagements.  We also train our LE colleagues, particularly in fraud, data-heavy inquiries, executive impropriety, sexual harassment, deep background, technology domains, cybersecurity from a board perspective, global operations, and the complex financial transactions that comprise our civil investigative specialties and our government contracts.  We’ve investigated LE misconduct and cleared the good guys.

So the question got asked: Were we somehow conveying a wrong impression—a bad impression—about law enforcement when we said that we operate without law enforcement bias?  (Answer: Probably, yes.)  What did that even mean, anyway?  (Read on.)

We meant the art and science of “building a case,” principally referring to the manner in which a criminal case is usually investigated and prosecuted by LE and the prosecutors whom they have to work for and support.  That’s a key point, and it differs substantially from SI’s approach, which skews heavily to massive data, information, and innovation, always.

LE looks at things another way, which is absolutely crucial to success in that dominion.  The determination that a crime has been committed, based on preliminary evidence and a review of the elements constituting the crime.  Theory of the case.  Developing leads.  Finding suspects.  Eliminating some suspects through established investigative procedures and proven investigative methods.  Following procedures.  Not making mistakes.  Narrowing the suspect pool.  Collecting evidence based on revised and adapted theories of the case.  Careful chains of custody.  Careful discovery as well—especially where potential Brady materials are concerned . . . with no desire to create materially exculpatory evidence that will either enable a strong defense or hand a defense attorney an excellent alternative theory of the crime.  Most critically, build the case structurally strong so that it will hold up when attacked . . . because a LE investigator’s work, reputation, and integrity will be hammered in court.  After all, criminal law is supposed to be adversarial.  The stronger, the more unassailable a case is built, the better chance there is that the perpetrator will take a plea—or be found guilty.

It’s a phenomenally successful method.

But in our long experience, in our kinds of cases, the general law enforcement methods favored by investigators with LE backgrounds present clients—especially law firms and government leaders, and more especially in cyber risk management—with problematic results.

While that case is being built, a whole lot of fraud, deception, destruction of evidence, husbanding of evidence within the attorney-client privilege, dissembling, false flagging, and well-thought-out prevarication can all be going on—far away from the focus and out of the field of view of the investigation.

That’s where we operate.  To be fair, we have a bias too.  All investigations bear some manner and level of cognitive bias . . . to suggest otherwise would be to deny human behavior and reality.

We define ours as an audit bias.  Our SI approach to investigations and cyber risk management takes on three characteristics that are different from the way law enforcement, and LE-experienced investigators (generally) work . . . and here we mean to include the law firms who offer up former Justice Department attorneys as case managers for the former FBI agents who actually do the legwork of their investigations.

We are voracious collectors of evidence and we believe that evidence is agnostic.  We are very data-driven.  We know from decades of experience what methods corporations and fraudsters use to dissemble and to prevail, including how they curate filings and Internet presence to enfranchise a particular story line, to mislead LE or legal-style investigations.  In short, we know the tricks of case prestidigitation, especially in finance, fraud, corruption, sexual misconduct, the cyber domains, and lawsuits . . . because we’ve been on the receiving end of them as C-level corporate leaders, and we have the (strictly metaphorical) scars on our backs to prove it.

We are trained as auditors and we know accounting and finance intimately.  We know fraud.  We conduct fraud audits—a key core competency of SPECINV and SI Cyber, where our actual investigators and professional services providers have letters behind their names like CPA and CFE.  Audit, investigation, and C-level/board-level risk management are, of course, different skill sets.  But our application of the skills of auditors to the processes of investigation and risk analysis makes us unique.  Many of our methods are proprietary.   We have no desire to share, demonstrate, and disseminate our systems . . . which would essentially show the bad guys how we work.  Our field of vision is very broad and long.

We are deeply collaborative.  We are self-critical.  We examine inherent conflicts.  We explore Rumsfeldian known unknowns and unknown unknowns.  We assess and reassess.  We reboot frequently.  We develop and use the sources that are most often overlooked or unconsidered.  These skills are best understood in the context of how the US Intelligence Community works, in contrast to the way that law enforcement-style investigations usually work.

We are comfortable with shades of gray, with probable outcomes, with decision-making under conditions of uncertainty, with cultural contexts other than the United States, with complexity, with truth that isn’t always pretty, with complicated people and mixed motivations . . . with organizing all of the stuff that in the end analysis enables decisions to be made with integrity, decency, clarity, transparency, responsiveness, and accountability.

That troublesome “without law enforcement bias” tagline did not survive those conversations.  The decision to abandon that assertion was part of our process of continual strategic reassessment, and our sharing it here is part of our commitment to transparency and integrity.

We believe that our clients, our greater constituencies . . . and especially our law enforcement colleagues . . . should know what we talk about inside SI, SPECINV, and SI Cyber.

To all of you: Respect.