All Investigations Lead to...Porn?

It all started with a joke.

"All investigations seem to lead to pornography," quipped Ryan Hubbs, a senior manager for Matson, Driscoll & Damico, Forensic Accountants, chatting with a group of colleagues at an ACFE conference a few years ago.

Hubbs had spotted an odd pattern. Time after time, as he investigated claims of contractor fraud or embezzlement, he'd uncover a little something on the side, such as additional accusations of bullying or harassment or, most frequently, pornography downloaded onto an accused employee's computer.

His joke struck a nerve. "We started talking about it," he recalls, "and everybody else said, 'You know, I've had some cases where after we did the forensic analysis, we found the guy was also investigated for sexual harassment.'" That's when Hubbs started to wonder whether what he was seeing was mere coincidence, or correlation.

"The correlation is somewhere between zero and a hundred percent," Hubbs jokes, admitting that he's no social scientist. Plenty of people, he contends, have glanced at a sexy photo or two online without ever going on to commit fraud. He's reluctant to draw any absolute conclusions about correlation or causality.

But as a professional fraud examiner, he is a keen observer of human behavior. And in his fascinating lecture at the San Diego ACFE conference in June, he shared those observations and posed a question to fellow investigators: What if we could search out fraudsters by zeroing in on employees who download porn or have been reported for bullying or harassing co-workers? Is there a strong enough correlation between outright fraud and other "deviant" behaviors to use those behaviors as markers?

Hubbs defines deviant behavior as any practice that falls outside of the law, societal norms, or company policies. And although looking at girlie pictures might be considered a ubiquitous enough practice to fall within societal norms on one's own time, it's still not considered an acceptable work activity, and it carries with it certain risks to employers. "Not only do you have hostile work claims which can (lead to) lawsuits," he says. "But in doing these types of investigations over the years, I've seen some people continue to spiral down, from regular nudity to hard-core porn…and some individuals move into the child porn arena.

"Imagine if they save that onto the main server," Hubbs adds. "When the FBI comes in…they take the whole server."

Deviance is relative, Hubbs admits. "What is deviant behavior today might not be deviant behavior 20 years from now." And he says that most of us do things every day that might deviate from laws, norms, or workplace policies.

But a good investigator with strong instincts about human behavior and motivations, he asserts, might be able to sniff out financial malfeasance by focusing on patterns of behavior that reveal an employee's or contractor's…proclivities. If a person tends towards risky behaviors, like downloading thousands of pornographic images onto his work computer or texting inappropriate messages or images to co-workers, he might also take risks in other ways, like fudging expenses or rigging bids.

Hubbs's hypothesis has fellow investigators intrigued. He gets lots of questions he can't answer, because there's just not enough research out there yet to support his ideas with hard numbers. He's not offering a solution, just posing a challenge to his colleagues to observe and find out more.

"Look, I just kind of kicked this ball onto the court," he says. "You guys can take it any direction you want to go. This is an observation that I had over the years, and wanted to pose it to the rest of the populace to see if it's useful and what else can we learn from this."  

  -KDG

[FIND] Lexicon - Discourse Analysis

"In the end, discourse analysis is one way to engage in a very important human task. The task is this: to think more deeply about the meanings we give people's words so as to make ourselves better, more humane people and the world a better, more humane place."
- J. P. Gee 

Don Rabon, former Deputy Director of the North Carolina Department of Justice, recently gave a lecture at the ACFE 22nd Annual Fraud Conference. Mr. Rabon is quite possibly a genius. After listening intently for 80 minutes about interview techniques, tied logically to historical literature (Interviewing From Head to Poe), I found myself lost in words; the dissection of words, the parsing of sentences, and the importance of listening and recording (documenting).

I left the class and near sprinted to the ACFE Bookstore, set up in the voluminous exhibit hall, and picked up my first Don Rabon book, Investigative Discourse Analysis. I read the book on the way home on a long flight from San Diego back to Nashville. It's a language nerd's dream.

Upon arriving back at my office the following day, I tried a small experiment. Several months ago a long time client asked me to look into a couple of emails he had received. They weren't necessarily threatening, but they were - just mean. We tried to identify the sender and have a strong idea who the passive-aggressive-cyber-punk was. We could not, however, tie them specifically to the emails. They used a gmail account, more on that at a later date, which when used properly is a fantastic way to mask one's identity.

We did have one email from the suspected ill-meaning-emailer denying all knowledge of the affair. Well, I put that denial email, the statement, under serious scrutiny using Mr. Rabon's book as a guide.

Structure - The email, the suspect's statement, showed structural imbalance, indicating that it was deceptive on its form. The anonymous-jackass-email-fiend told her account of the incident. The prologue made up roughly 10% of the narrative. The actual event (the sending of the email) took up 30%. The remaining 60% of the text was dedicated to the epilogue and a string of negations and denials. Structurally, this narrative is seriously indicative of deception, but it was the analysis of specific words that caught my attention.

Word Choice - The disgruntled-email-bully used the pronoun I, exclusively, throughout the first part of the email. She switched to a near exclusive use of the pronoun Me in the last part of the narrative. Indicating that she had somehow a passive role, almost a victim.

Sentence Length - When the narrative turned to the actual event, her Mean Length of Utterance (MLU) dropped from a Mean of 13.3 to truncated sentences of 5 to 7 words or less. Further indication of deception.

Other issues - The denial email, which again equated to a statement, had several other issues. The most interesting point I noted in the email was the bookending of the statement, first sentence and last sentence, with abjuration (I don't mean to upset you, but...).

I would not feel comfortable approaching a court, a lawyer, or a jury with my brief analysis. I do not possess the skill and training to apply this type of analysis in detail or for court testimony. I do, however, feel comfortable that we now know, based an analysis of the denial email, who wrote the original string of nasty notes.

This, for me, falls into the category of simply cool. If you get the chance, click over to Amazon or the ACFE bookstore and pick up a copy of Don Rabon's book, Investigative Discourse Analysis.

ACFE Fraud Conference - Day 2

As usual, The ACFE has hosted a magnificent event. From the opening ceremony to the last session of the day, entertaining and informative.

I particularly enjoyed the talk from Joan Pastor in the morning general session. Ms. Pastor took the podium after the opening speeches and owned the room for far too short a time. I could have listened to her all morning. I am officially begging the ACFE to bring her back for more.

My favorite part of the day, aside from the evening cocktails, was a presentation on how technology has changed fraud investigation. Jean-Francois Legault is a large man, very large man, with a personality to match. He is a perfect example of the level of professionalism and skill that the ACFE has amassed. Professional experience paired with presentation skills, and what appears to be a very healthy avoidance of the standard bullet-point-boresome-PowerPoint-sleep-aid usually employed by Conference speakers. Thank you Mr. Legault.

Assuming I have the energy, I'll try and post again this afternoon. We'll see.

ACFE Fraud Conference - Day 1 (part 1)

I got in last night around 7:00. Checked in, settled in, and struck out in search of a good martini. Found one at Royal India. There was an ACFE sign in the window.

This morning I strolled the Gaslamp and noticed that most restaurants have an ACFE sign in the window, including the Gaslamp Strip Club, which gave me pause. Turns out it's a steak house.

Not sure what to expect from the next several days, but I'm looking forward to learning a lot and meeting some good people.

More later.