What the Police should have done

July 8th, 2009 at 1:00 pm by David Farrar

The Complaints Authority is investigating the adequacy of the investigation into the e-mails. As far as one can tell from the released file, the Police did nothing beyond chatting to half a dozen people.

From what I can tell, there was no forensic examination of the evidence – something that should have been the first step taken by the Police. What do I mean by this – I mean an investigation of what actual documents Nicky Hager gained a copy of.

Hager helpfully supplied around 1,000 references in his 350 page book. The very first step of a semi-competent investigation would be to examine the documents referenced. Here is what I would have done:

  1. Compile a masterlist of every document referenced in Hager’s book
  2. Sort them into groups – e-mails, faxes, etc
  3. For the e-mails record down when each e-mail was received, and when it was deleted if it was. This will provide a window of time as to when the theft occured.
  4. Also for each e-mail record who has access to it. Who was cc’d or bcc’d it. Who had access to a printed copy.
  5. Look for common patterns in access, to try and narrow down which e-mail account or accounts were probably accessed
  6. Look at the date of the final document used in the book. It is likely the theft took place soon after that.
  7. Obtain staff lists for National during that period. Look especially at anyone who joined just before the thefts occurred.
  8. Obtain swipe card records for the Leader’s Office for the period just after the final documents cited.

I’m not saying this would work out who did it. I’m saying this is the minimum first steps you would expect in a competent investigation – work out what documents were stolen, work out who had access to them, work out whether they were in electronic form or also existed in hard copy, and work out when they were probably stolen. This is basic stuff.

By failing to do this the investigation was, in my opinion, doomed to fail, Asking half a dozen people whether or not they will tell them who gave them the e-mails was never going to find anything. A proper detailed forensic approach to the investigation could well have led somewhere, or even provided clarity as to whether the theft came about from a one off access to someone’s inbox, or whether it was more systematic than that.

I am going to be very interested in the report and findings of the Police Complaints Authority.

Tags: , , ,

24 Responses to “What the Police should have done”

  1. davidp (3,576 comments) says:

    I used to investigate this sort of thing as part of my job. The first thing I would have done was taken a copy of the evidence… Mail files. Sent and received log files. And other log files I could find. I’d want copies of hard drives. And the access control lists. It was very easy for an administrator or user to bugger up their access control settings in Lotus Notes, and then it was possible that anyone could read your e-mail. But it is easy to lose this sort of evidence if an upgrade resets things, if media are reused, or if Police take a couple of years to get around to beginning their investigation.

    This sort of thing was almost easier if the target of the investigation didn’t know they were the target. As with any sort of crime, you don’t want people destroying evidence. My team started and completed forensic investigations on one person who was on holiday, another who was on his honeymoon (and returned to work to find he’d been suspended… which taught him a lesson about surfing the web for granny porn in work time), and managed to lure one target out of his office so that we could examine the computer while it was running and logged on. The last thing I would have done in any of these cases was to wander up to someone and asked them what they were up to.

    [DPF: There were daily backups onto tape so if an e-mail was deleted you can tell when, and that would help pinpoint when it was accessed or stolen]

    Vote: Thumb up 0 Thumb down 0 You need to be logged in to vote
  2. wreck1080 (3,857 comments) says:

    Maybe Helen suggested to her mates in the cops that they should quietly bury the case?

    Vote: Thumb up 0 Thumb down 0 You need to be logged in to vote
  3. MyNameIsJack (2,415 comments) says:

    Or they could have just decided it was a lover’s spat and left it to Bill and don to work out between them.

    [DPF: 20 demerits]

    Vote: Thumb up 0 Thumb down 0 You need to be logged in to vote
  4. mickysavage (786 comments) says:

    So DPF are you now saying it was an inside job?

    [DPF: I don't know. I have never ruled out that it was someone with physical access to the Leader's Office. Someone could have used a flash drive to copy a pst file in 60 seconds - maybe a temporary secretary, maybe a visitor. Would be hugely hugely surprised if it was a political staffer etc.

    OTOH maybe it was an electronic access. Again we don;t know as Police investigation was so flawed. A proper investigation could well rule in or out that it was a physical access or an electronic access - or both]

    Vote: Thumb up 0 Thumb down 0 You need to be logged in to vote
  5. Bog Roll (6 comments) says:

    Surely an inside job. The real answers lie deep within the National Party.

    The longer Brash keeps banging on, the more voters get reminded of The Hollow Men. Probably a measurable boost in sales with every headline! For all concerned, except Nicky Hager, this should be buried ASAP.

    Vote: Thumb up 0 Thumb down 0 You need to be logged in to vote
  6. Rex Widerstrom (5,349 comments) says:

    Yes, yes that’s all very well David. But you’ve missed an important first step, without which none of the others can occur.

    1. Remove Commissioner Broad’s nose from the [alright, I'll just censor myself here, to save you the trouble].

    Vote: Thumb up 0 Thumb down 0 You need to be logged in to vote
  7. Paulus (2,602 comments) says:

    A sad reflection of the times, of in principle, a fine uncorrupted police force.

    You would think that they would want to exonerate themselves competently, but Helen screwed them for a long time to come.

    Vote: Thumb up 0 Thumb down 0 You need to be logged in to vote
  8. RKBee (1,344 comments) says:

    “Here is what I would have done” Blur Blur Blur…

    This is very commendable to think that you can do a better job than the Police Complaints Authority. You would be a moron to think politics is not at play here with the Police Complaints Authority or they are not constrained by politics.
    You me or anyone could do a better job without those restraint’s.

    Vote: Thumb up 0 Thumb down 0 You need to be logged in to vote
  9. emmess (1,422 comments) says:

    I wonder what Nicky Hagar’s views are on school league tables being printed.

    Private stolen emails – public interest?
    Basic information regarding public education – top secret?
    How would any rational person justify that?

    Nobody tell me he would be for releasing the league tables.
    When ever have those Marxist Green Left types ever veered from the party line?

    Vote: Thumb up 0 Thumb down 0 You need to be logged in to vote
  10. Inventory2 (10,267 comments) says:

    Well said emmess – Hager has a lot to answer for.

    Vote: Thumb up 0 Thumb down 0 You need to be logged in to vote
  11. backster (2,141 comments) says:

    I agree that the sham of an enquiry is a disgrace and brings the Police into disrepute. BROAD is answerable for this, he would have had oversight of this enquiry and the fact that he remains Commissioner is as big a mystery, (and miscarriage of justice) as Michael CULLEN being given directorship of Kiwibank… It is obviously the hand of the former Liabour Witch at play manipulating her puppets, in the same manner she engineered the removal of Commissioner DOONE../ Liabour trolls now at play on this forum trying to lay the blame elsewhere are as convincing as Goff was over the Neelam Choudhary allegations.

    Vote: Thumb up 0 Thumb down 0 You need to be logged in to vote
  12. petal (705 comments) says:

    But David, the Police Commissioner, what’s her name again?, oh yes, Helen Clarke, decided it wasn’t in the public interest.

    Vote: Thumb up 0 Thumb down 0 You need to be logged in to vote
  13. gd (2,286 comments) says:

    My forensic examination would have consisted of one step

    Waterboard Hager until he confessed.

    Vote: Thumb up 0 Thumb down 0 You need to be logged in to vote
  14. Jack5 (5,014 comments) says:

    Bog Roll blogged ad 3.22:” ..For all concerned, except Nicky Hager, this should be buried ASAP.”

    The Lefties, especially Hager the Horrid’s mates, want this shut down. To hell with them.

    IF the pressure stays on the truth will out.

    There are two issues. Who gave the emails to leftist hit man Hager, and second, and now more important, who’s responsible for the police not doing their job in the inquiry.

    Good on you DPF for helping keep this issue alive. The fact that posters like Bog Roll want it shut down, shows the perpetrators in these two scandals can be outed.

    Vote: Thumb up 0 Thumb down 0 You need to be logged in to vote
  15. Cerium (23,436 comments) says:

    Has anyone claiming political interference in the investigation got anything credible to base their claims on?
    Or is it just jumping on the conclusion bandwagon?

    Vote: Thumb up 0 Thumb down 0 You need to be logged in to vote
  16. side show bob (3,660 comments) says:

    I doubt anyone currently in power really gives a fat rat’s butt who did it. No need to drag the skeletons out of the closet when those in power have got what they want. Sure Liarbore might be pissed that they got the big A but I doubt any guilt proven will change piss all and as far as National are concerned any guilt put down in their name will probably matter very little to the voting public.

    Vote: Thumb up 0 Thumb down 0 You need to be logged in to vote
  17. Jack5 (5,014 comments) says:

    Political interference is a reasonable line of inquiry Cerium (4.11 post). Going on the control mania of H1, her ruthlessness, and her record on telling the truth it’s quite plausible that her regime was involved in causing the police inertia.

    Vote: Thumb up 0 Thumb down 0 You need to be logged in to vote
  18. Cerium (23,436 comments) says:

    I’m not against inquiring into it if there is reasonable reason to suspect, that’s a lot different to insinuation and accusation based on partisan guesswork or fantasy.

    Vote: Thumb up 0 Thumb down 0 You need to be logged in to vote
  19. mickysavage (786 comments) says:

    Jack5

    “The Lefties, especially Hager the Horrid’s mates, want this shut down. To hell with them. ”

    Actually if the rumours that I hear are true I would actually like the truth to come out. Deep dark secret anyone?

    Vote: Thumb up 0 Thumb down 0 You need to be logged in to vote
  20. Jack5 (5,014 comments) says:

    Cerium…

    There’s already an inquiry. Emails were stolen. They benefited Labour. The partisan fantasy is on the part of lefties who think the political lynching of Don Brash is going to quietly fade. Dead wrong!

    Vote: Thumb up 0 Thumb down 0 You need to be logged in to vote
  21. Cerium (23,436 comments) says:

    And they may also have benefited someone (or ones) in National. If it was an inside job it wouldn’t have been to try and extend Labour’s time in government.

    Vote: Thumb up 0 Thumb down 0 You need to be logged in to vote
  22. Bog Roll (6 comments) says:

    Surely the National Party had means, motive, and opportunity to do away with Brash? And then install a nice shiny new leader, who went on to win the next election?

    and everyone lived happily ever after…except DB of course.

    If this was unprovoked theft by an outside party, or even a mole, the National machine would have seen IT experts and private investigators jamming the corridors immediately.

    Hardly wonder at the police thinking ‘Nat Spat!” and moving on…..

    Vote: Thumb up 0 Thumb down 0 You need to be logged in to vote
  23. GPT1 (2,116 comments) says:

    Compare this with the SFO investigation of National. Documents and files seized – a massive investigation over some backstabbing as I understand it. Here there is theft and there are no search warrants, no effort and no investigation.

    Vote: Thumb up 0 Thumb down 0 You need to be logged in to vote
  24. LUCY (359 comments) says:

    The only thing that a can conclude from this post is that the New Zealand Police are incredibly stupid. It is either that or they are corrupt. Take your pick Mr Broad.

    Vote: Thumb up 0 Thumb down 0 You need to be logged in to vote

Leave a Reply

You must be logged in to post a comment.