Structured Data Analysis: Proving a Negative in Cases of Fraud

2020 has seen the world thrown into turmoil as a deadly virus continues to spread across the globe. To help manage the pandemic, governments have put into place measures to help businesses stay afloat. These measures have taken on many forms, from small business loans to supporting employee wages during lockdowns. Trillions have been spent but have all those benefiting from aide been on the receiving end in good faith? Not all.

It is estimated that upwards of 10% of claims, irrespective of jurisdiction or government scheme, are fraudulent. Even more were filed incorrectly or without a clear understanding of whether the corporation met the criteria for support in the first place. Governments across Europe and around the world are now looking to determine whether the funds provided were done so through fraudulent behaviour or were valid claims with evidence to prove the same.

One aspect of great concern includes whether employees who were asked to stay home in actually stayed home. Take the U.K. as an example. Under the British furlough scheme, 80% of employee wages were covered by the government during the period of forced lockdown. Quite literally overnight, on 26 March, the people of the UK were told not to go into work. For many, jobs could be done from home, but for most this was not an option. This is a scenario that has played across The Continent.

With so much spent to keep people safe and at home, it is not surprising governments are now looking to claw back some of these funds. In many cases, discrepancies were due to mistakes in procedure or understanding and for these, a grace period was provided to come forward and return any unwarranted benefit, no questions asked. For others, however, who might have acted in bad faith and did not come forward voluntarily, steep fines would be levied if insufficient evidence of compliance in the scheme was not followed.

How does one provide evidence to a negative? How does one prove employees did not work?

Structured data is one avenue of electronically stored information (ESI) that can provide additional clues leading to insights related to an individual’s activities. Comprised of information that has pre-defined parameters and organisational structure, it can be either human or machine-generated. Data primarily consist of fields populated with content that can be easily organised and searched but has little in terms of context or immediate value.

Personal identification numbers, GPS locations, phone numbers and virtually anything that can be logged or formatted would fall under this category of ESI.

When looking to define a person’s workday, it is important to understand in what regular activities he or she participated. Unfortunately, for those who have been furloughed, work-related responsibilities fall outside of the ordinary course of investigation, i.e., email and computer-driven activity. This said, living in the modern age of technology, very few jobs fall completely outside all for of electronic tracking.

iDS have developed an approach to gather this myriad of structured data streams helping corporations to identify what “a day in the life” of its employees looks like. Called “Fact Crashing” and similar to a data mapping exercise found in a more standard approach, consultants help pinpoint the many avenues of stored data that can help define a person’s day. From time stamps and video surveillance footage to mobiles location services and identification logins, dozens of data points can be identified. Some are easily collected and processed whereas others might be more difficult or protected under data privacy regulations. This said, it only takes 3 or 4 well-defined tracks to create a solid benchmark of work-related activity.

Once we know what the ordinary day looks like for the average employee, it is relatively straight forward to identify when this activity falls to nothing, exactly what an organisation would be looking for when trying to prove that a furloughed employee did in fact stay home as required. If these same streams can be applied across an entire department or the entire company in general, very quickly an investigative consultant can identify those who were working and those who were not during a specifically define time period. Invaluable should a government regulator come knocking on the door asking whether or not funds in support of the scheme were properly distributed.

Discovery technology has historically focused on specific forms of data. Email, human authored documents, and chats to name a few have all been the focus of digital interrogation procedures, helping provide the evidence necessary to prove a point or develop a legal argument. Some investigations are not so lucky and we as consultants need to look elsewhere when mining for information that can provide clarity to a particular event.

iDS specialise in structured data analysis, developing workflows based upon sound digital investigative procedure and practice. From identification, through normalisation and interrogation, to visualisation and presentation, iDS consultants partner with their clients to determine how structure data can identify work activity, or better yet, lack thereof when providing evidence that fraudulent behaviour does not exist.

Daniel Rupprecht

iDiscovery Solutions
iDiscovery Solutions is a strategic consulting, technology, and expert services firm – providing customized eDiscovery solutions from digital forensics to expert testimony for law firms and corporations across the United States and Europe.